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Foreword 



This Technical Specification (TS) has been produced by ETSI Project Smart Card Platform (SCP). 

It is based on work originally done in the 3GPP in TSG- terminals WG3. 

The contents of the present document are subject to continuing work within EP SCP and may change following formal 
EP SCP approval. If EP SCP modifies the contents of the present document, it will then be republished by ETSI with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

early working draft; 

1 presented to EP SCP for information; 

2 presented to EP SCP for approval; 

3 or greater indicates EP SCP approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



The present document defines a generic Terminal/Integrated Circuit Card (ICC) interface. 

The aim of the present document is to ensure interoperability between an ICC and a terminal independently of the 
respective manufacturer, card issuer or operator. The present document does not define any aspects related to the 
administrative management phase of the ICC. Any internal technical realization of either the ICC or the terminal is only 
specified where these are reflected over the interface. 

Application specific details for applications residing on an ICC are specified in the respective application specific 
documents. The Universal Subscriber Identity Module (USIM)-application for 3G telecommunication networks is 
specified in TS 131 102 [2]. 
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1 Scope 

The present document specifies the interface between the UICC and the terminal. 
The present document specifies: 

• the requirements for the physical characteristics of the UICC; 

• the electrical interface between the UICC and the terminal; 

• the initial communication establishment and the transport protocols; 

• the model which serves as a basis for the logical structure of the UICC; 

• the communication commands and the procedures; 

• the application independent files and protocols. 

The administrative procedures and initial card management are not part of the present document. 

2 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication and/or edition number or version number) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. 

Referenced documents which are not found to be publicly available in the expected location might be found at 
http://docbox.etsi.org/Reference . 

[1] ETSI TS 123 038: "Digital cellular telecommunications system (Phase 2+); Universal Mobile 

Telecommunications System (UMTS); Alphabets and language-specific information 
(3GPP TS 23.038 Release 5)". 

[2] ETSI TS 13 1 102: "Universal Mobile Telecommunications System (UMTS); Characteristics of the 

USIM AppHcation (3GPP TS 31.102 Release 5)". 

[3] ETSI TS 101 220: "Smart cards; ETSI numbering system for telecommunication appUcation 

providers (Release 5)". 

[4] ETSI TS 102 223: "Smart cards; Card Application Toolkit (CAT)". 

[5] ITU-T Recommendation E. 1 18: "The international telecommunication charge card". 

[6] ISO 639: "Codes for the representation of names of languages". 

[7] ISO/lEC 7810: "Identification cards - Physical characteristics". 

[8] ISO/lEC 781 1-1: "Identification cards - Recording technique - Part 1: Embossing". 

[9] ISO/lEC 7816-1: "Identification cards - Integrated circuit(s) cards with contacts - Part 1: Physical 

characteristics". 

[10] ISO/lEC 7816-2: "Information technology - Identification cards - Integrated circuit(s) cards with 

contacts - Part 2: Dimensions and location of the contacts". 
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[11] ISO/IEC 7816-3: "Information technology - Identification cards - Integrated circuit(s) cards with 

contacts - Part 3: Electronic signals and transmission protocols". 

[12] ISO/IEC 7816-4: "Information technology - Identification cards - Integrated circuit(s) cards with 

contacts - Part 4: Interindustry commands for interchange". 

[13] ISO/IEC 7816-5: "Identification cards - Integrated circuit(s) cards with contacts - 

Part 5: Numbering system and registration procedure for application identifiers". 

[14] ISO/IEC 7816-6: "Identification cards - Integrated circuit(s) cards with contacts - 

Part 6: Interindustry data elements". 

[15] ISO/IEC 7816-8: "Identification cards - Integrated circuit(s) cards with contacts - Part 8: Security 

related interindustry commands". 

[16] ISO/IEC 7816-9: "Identification cards - Integrated circuit(s) cards with contacts - 

Part 9: Additional interindustry commands and security attributes". 

[17] ISO/IEC 10646-1: "Information technology - Universal multiple-octet coded Character 

Set (UCS) - Part 1: Architecture and basic multilingual plane". 



3 Definitions, symbols, abbreviations and coding 

conventions 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

access conditions: set of security attributes associated with a file 

ADM: access condition to an EF which is under the control of the authority which creates this file 

application: set of security mechanisms, files, data and protocols (excluding transmission protocols) 

NOTE: An application can be a first level application and/or a second level application. 

application DF: entry point to an application 

application protocol: set of procedures required by the application 

card session: link between the card and the external world starting with the ATR and ending with a subsequent reset or 
a deactivation of the card 

channel session: link between the card and the external world during a card session on a given logical channel, starting 
with the opening of the logical channel and ending with the closure of the logical channel or the termination of the card 

session 

class A operating conditions: terminal or a smart card operating at 5 V + 10 % 

class B operating conditions: terminal or a smart card operating at 3 V + 10 % 

class C operating conditions: terminal or a smart card operating at 1,8 V + 10 % 

current directory: latest MF, DF or ADF selected 

current EF: latest EF selected 

data object: information coded as TLV objects, i.e. consisting of a Tag, a Length and a Value part 

Dedicated File (DF): file containing access conditions and, optionally. Elementary Files (EFs) or other Dedicated Files 
(DFs) 

directory: general term for MF, DF and ADF 
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Elementary File (EF): file containing access conditions and data and no other files 

file: directory or an organized set of bytes or records in the UICC 

file identifier: 2 bytes which address a file in the UICC 

first level application: selectable application that is indicated in EFj-,jj^ under the MF (e.g. a USIM application) 

function: contains a command and a response pair 

GSM session: part of the card session dedicated to the GSM operation 

ID-1 UICC: UICC having the format of an ID-1 card 

NOTE: See ISO/IEC 7816-1 [9]. 

Lc: length of command data sent by the application layer in a case 3 or 4 Command 

Le: maximum length of data Expected by the application layer in response to a case 2 or 4 Command 

Luicc: exact Length of data available in the UICC to be returned in response to the case 2 or 4 Command received by 
the UICC 

Master File (MF): unique mandatory file containing access conditions and optionally DFs and/or EFs 

multi-application capable terminal: terminal that can support more than one first level application with possibly 
separate user verification requirements for each application 

multi-application card: card that can have more than one selectable application 

multi-session card: card that supports more than one concurrent selectable application session during a card session 

multi-verification capable UICC: card that can have more than one first level application and may support separate 
user verification requirements for each application 

normal USIM operation: relating to general, PIN related, 3G and or GSM security and subscription related procedures 

padding: one or more bits appended to a message in order to cause the message to contain the required number of bits 
or bytes 

1,8 V technology smart card: smart card operating at 1,8 V + 10 % and 3 V + 10 % 

1,8 V technology terminal: terminal operating the smart card - terminal interface at 1,8 V + 10 % and 3 V + 10 % 

plug-in UICC: second format of UICC 

proactive UICC: UICC, which is capable of issuing commands to the terminal 

NOTE: Part of CAT. 

record: string of bytes within an EF handled as a single entity 

record number: number, which identifies a record within an EF 

record pointer: pointer, which addresses one record in an EF 

second level application: application which can only be activated during the session of a first level application 

NOTE: A second level application may have an AID. This AID shall not be stored in EF(DIR) unless it is also a 
first level application. 

selectable application: application that is selectable by an AID according to the process described in ISO/IEC 7816-4 
over the terminal-UICC interface 

selectable application session: link between the application and the external world during a card session starting with 
the application selection and ending with de-selection or termination of the card session 
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single verification capable UICC: card that only supports one user verification requirement for all first level 
applications 

state H: high state on the I/O line (Vcc) 

state L: low state on the I/O line (Gnd) 

3 V technology smart card: smart card operating at 3 V + 10 % and 5 V + 10 % 

3 V technology terminal: terminal operating the smart card - terminal interface at 3 V + 10 % and 5 V + 10 % 

type 1 UICC: UICC which always enters the negotiable mode after a warm reset 

type 2 UICC: UICC which always enters the specific mode after a warm reset 

CAT AppUcation Toolkit procedures: See TS 102 223 [4]. 

USIM session: selectable application session for a USIM application 

3.2 Symbols 

For the purposes of the present document, the following symbols apply: 



Gnd 


Ground 


tp 


Fall time 


tR 


Rise time 


Vcc 


Supply Voltage 


VlH 


Input Voltage (high) 


ViL 


Input Voltage (low) 


VOH 


Output Voltage (high) 


Vol 


Output Voltage (low) 


Vpp 


Programming Voltage 



3.3 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

AC Access Condition 

ACK ACKnowledge 

ADF Application Dedicated File 

AID Application IDentifier 

ALW ALWays 

AM Access Mode 

AM-DO Access Mode Data Object 

APDU Application Protocol Data Unit 

ARR Access Rule Reference 

AT Authentication Template 

ATR Answer To Reset 

BCD Binary Coded Decimal 

BER Basic Encoding Rules 

BGT Block Guard Time 

BWT Block Waiting Time 

C-APDU Command APDU 

CAT Card Application Toolkit 

CCT Cryptographic Checksum Template 

CLA CLASS 

CLK CLocK 

CRT Control Reference Template 

CT Confidentiality Template 

C-TPDU Command TPDU 

CWI Character Waiting Integer 
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CWT Character Waiting Time 

DAD Destination ADdress 

DF Dedicated File 

DO Data Object 

DST Digital Signature Template 

EDC Error Detection Code byte 

EF Elementary File 

etu elementary time unit 

f frequency 

FCI File Control Information 

FCP File Control Parameters 

Fi clock rate conversion factor 

FID File IDentifier 

GSM Global System for Mobile communications 

I/O Input/Output 

I-block Information block 

ICC Integrated Circuit Card 

ID IDentifier 

lEC International Electrotechnical Commission 

IFS Information Field Sizes 

IFSC Information Field Size for the UICC 

IFSD Information Field Size for the terminal 

INF INFormation field 

INS INStruction 

ISO International Organization for Standardization 

LCSI Life Cycle Status Information 

LEN LENgth 

LRC Longitudinal Redundancy Check 

LSB Least Significant Bit 

ME Mobile Equipment 

MF Master File 

MSB Most Significant Bit 

NAD Node ADdress byte 

NEV NEVer 

OSI Open System Interconnection 

PI Parameter 1 

P2 Parameter 2 

P3 Parameter 3 

PCB Protocol Control Byte 

PDC Personal Digital Cellular 

PIN Personal Identification Number 

PPS Protocol and Parameter Selection 

PS PIN Status 

PS_DO PIN Status Data Object 

R-APDU Response APDU 

R-block Receive-ready block 

RFU Reserved for Future Use 

RST ReSeT 

R-TPDU Response TPDU 

SAD Source ADdress 

S-Block Supervisory Block 

SC Security Condition 

SC_DO Security Condition Data Object 

SE Security Environment 

SEID Security Environment IDentifier 

SFI Short (elementary) File Identifier 

SIM Subscriber Identity Module 

SM Secure Message 

SMS Short Message Service 

SMS-PP Short Message Service - Point to Point 

TETRA TErrestrial Trunked RAdio 

TLV Tag Length Value 
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TPDU 

UCS2 

UE 

USIM 

VPP 

WI 

WTX 

WWT 



Transfer Protocol Data Unit 

Universal Character Set 2 

User Equipment 

Universal Subscriber Identity Module 

Programming power input, optional use by the card 

Waiting time Integer 

Waiting Time extension 

Work Waiting Time 



3.4 Coding conventions 

For the purposes of the present document, the following coding conventions apply: 

All lengths are presented in bytes, unless otherwise stated. Each byte is represented by bits b8 to bl, where b8 is the 
Most Significant Bit (MSB) and bl is the Least Significant Bit (LSB). In each representation, the leftmost bit is the 
MSB. 

In the UICC, all bytes specified as RFU shall be set to '00' and all bits specifies as RFU shall be set to 0. If the GSM 
and/or USIM application exists on a UICC or is built on a generic telecommunications card, then other values may 
apply for the non-GSM or non-USIM applications. The values will be defined in the appropriate specifications for such 
cards and applications. These bytes and bits shall not be interpreted by a terminal in a GSM or 3G session. 

The coding of Data Objects in the present document is according to ISO/IEC 7816-6 [14]. 



Physical characteristics 



Two physical types of UICCs are currently specified by the present document. These are the "ID-1 UICC" and the 
"Plug -in UICC". At least one of the card sizes shall be supported by a terminal that is compliant to the present 
document. 

The physical characteristics of both types of UICCs shall be in accordance with ISO/IEC 7816-1 [9] and 

ISO/IEC 7816-2 [10] unless otherwise specified by the present document. The following additional requirements shall 

be applied to ensure correct operation in a Telecom environment. 



4.1 



ID-1 UICC 



The physical characteristics of the ID-1 UICC shall conform to ISO/IEC 7816-1 [9] and ISO/IEC 7816-2 [10]. 

The terminal shall accept embossed ID-1 UICCs. The embossing shall be in accordance with ISO/IEC 781 1-1 [8] and 
ISO/IEC 78 1 1 -3 (see bibliography). The contacts of the ID- 1 UICC shall be located on the front (embossed face, see 
ISO/IEC 7810 [7]) of the card. 



4.2 Plug-in UICC 



The Plug-in UICC shall have a width of 25 mm, a height of 15 mm, a thickness the same as an ID-1 UICC and a feature 
for orientation. 

Annex A of ISO/IEC 7816-2 [10] applies with the location of the reference points adapted to the smaller size. The three 
reference points PI, P2 and P3 measure 7,5 mm, 3,3 mm and 20,8 mm, respectively, from 0. The values in figure 2 of 
ISO/IEC 7816-2 [10] are replaced by the corresponding values of figure 4.1. 

The physical characteristics of the Plug-in UICC (Plug-in card) are defined in the present document. 
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Upper edge 




Figure 4.1 : Plug-in UICC 



4.3 Temperature range for card operation 

The temperature range for full operational use shall be between -25°C and +70°C with occasional peaks of up to +85°C. 
"Occasional" means not more than 4 hours each time and not over 100 times during the life time of the card. 



4.4 



Contacts 



4.4.1 Provision of contacts 



4.4.1.1 



Terminal 



Contacting elements in the terminal in positions C4 and C8 are optional, and are not used by a Telecom application 
complying with the present document. They shall present a high impedance to the UICC. If it is determined that the 
UICC is a multi-application UICC, then these contacts may be used. Contact C6 need not be provided for Plug-in cards 
or any card if the terminal does not support class A operating conditions (see ISO/IEC 7816-3 [11]). If present, C6 shall 
present a high impedance to the UICC. 



4.4.1.2 



UICC 



Contacts C4 and C8 need not be provided by the UICC. If provided, they shall not be connected internally in the UICC 
if the UICC only contains a Telecom application. Contact C6 shall not be bonded in the UICC for any function other 
than supplying Vpp. Contact C6 on a UICC not supporting class A operating conditions is RFU, 
see ISO/IEC 7816-3 [11]. 
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4.4.2 Contact activation and deactivation 

The terminal shall connect, activate and deactivate the UICC in accordance with the operating procedures specified in 
ISO/IEC 7816-3 [11]. 

For any voltage level, monitored during the activation sequence, or during the deactivation sequence following normal 
power-down, the order of the contact activation/deactivation shall be respected. 

It is recommended that whenever possible, the deactivation sequence defined in ISO/IEC 7816-3 [11] should be 
followed by the terminal on all occasions when the terminal is powered down. 

If the UICC clock is already stopped and is not restarted, the terminal may deactivate all the contacts in any order, 
provided that all signals reach low level before Vcc leaves high level. If the UICC clock is already stopped and is 
restarted before the deactivation sequence, then the deactivation sequence specified in ISO/IEC 7816-3 [11], clause 5.4 
shall be followed. 

When Vpp is connected to Vcc, as allowed in the present document for terminals supporting class A operation 
conditions only, then Vpp shall be activated and deactivated with Vcc, at the time of the Vcc activation/deactivation, as 
specified in the sequences of ISO/IEC 7816-3 [11], clauses 5.2 and 5.4. 

4.4.3 Inactive contacts 

The voltages on contacts CI, C2, C3, C6 and C7 of the terminal shall be in the range V + 0,4 V referenced to ground 
(C5) when the terminal is switched off with the power source connected to the terminal. The measurement equipment 
shall have a resistance of 50 kil when measuring the voltage on C2, C3, C6 and C7. The resistance shall be 10 kQ when 
measuring the voltage on CI. 



4.4.4 Contact pressure 



The contact pressure shall be large enough to ensure reliable and continuous contact (e.g. to overcome oxidization and 
to prevent interruption caused by vibration). The radius of any curvature of the contacting elements shall be greater than 
or equal to 0,8 mm over the contact area. 

Under no circumstances shall the contact force exceed 0,5 N per contact. 

Care shall be taken to avoid undue point pressure to the area of the UICC opposite to the contact area. Such pressure is 
potentially damaging to the components within the UICC. 



5 Electrical specifications of the UICC - Terminal 

interface 

The electrical specification in the present document covers the supply voltage range from 4,5 V to 5,5 V, 2,7 V to 3,3 V 
and 1,62 V to 1,98 V. For each state (Vqjj, Vjjj, Vj^ and VqjJ, a positive current is defined as flowing out of the entity 

(terminal or UICC) in that state. Vpp shall not be supported by the 3 V and 1,8 V technology terminal or the 
3 V and 1,8 V technology UICC. 

There are two states for the UICC while the power supply is on: 

• the UICC is in operating state when it executes a command. This state also includes transmission of the 
command from the terminal, executing the command and sending the response back to the terminal; 

• the UICC is in idle state at any other time. It shall retain all pertinent data during this state. In idle state, the 
clock may be stopped according to clause 6.6. 

The clock duty cycle shall be between 40 % and 60 % of the period during stable operation. A clock cycle is defined at 
50 % of Vcc from rising to rising edge or falling to falling edge. When switching clock frequencies terminals shall 
ensure that no pulse is shorter than 80 ns which is 40 % of the shortest allowed period. 
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5.1 Class A operating conditions 
5.1 .1 Supply voltage Vcc (contact C1 ) 

The terminal shall operate the UICC within the following limits. 

Table 5.1 : Electrical characteristics of Vcc under normal operating conditions 



Symbol 


Minimum 


Maximum 


Unit 


Vcc 


4,5 


5,5 


V 



The current consumption of the UICC shall not exceed the value given in the tables in clause 6.2.2 during the ATR 
(including activation and deactivation). 

When the UICC is in idle state (see below) the current consumption of the card shall not exceed 200 |i A at 1 MHz and 
25°C. If clock stop mode is enabled, then the current consumption shall also not exceed 200 [iA while the clock is 
stopped. 

The terminal shall source the maximum current requirements defined above. It shall also be able to counteract spikes in 
the current consumption of the card up to a maximum charge of 40 nAs with no more than 400 ns duration and 
amplitude of at most 200 mA, ensuring that the supply voltage stays in the specified range. 

NOTE: A possible solution would be to place a capacitor (e.g. 100 nF, ceramic) as close as possible to the 
contacting elements. 

5.1 .2 Reset (RST) (contact C2) 

The terminal shall operate the UICC within the following limits. 

Table 5.2: Electrical characteristics of RST under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


VOH 


lOHmax = +20 ^A 


Vcc - 0,7 


Vcc 
(see note) 


V 


Vol 


IOLmax = -200^A 


(see note) 


0,6 


V 


tptp 


Gout = Gin = 30 pF 




400 


MS 


NOTE: To allow for overshoot, the voltage on RST shall remain between 
-0,3 V and Vcc + 0,3 V during dynamic operation. 



5.1 .3 Programming voltage Vpp (contact C6) 

The UICC shall not require any programming voltage on Vpp. The terminal need not provide contact C6. If the terminal 
provides contact C6, then, in the case the terminal supports an ID-1 UICC under class A operating conditions only, the 
same voltage shall be supplied on Vpp as on Vcc, while in the case of Plug-in UICC the terminal need not provide any 
voltage on C6. Contact C6 may be connected to Vcc in any terminal supporting only class A operating conditions but 
shall not be connected to ground. 



£75/ 



Release 5 



19 



ETSI TS 102 221 V5.4.0 (2003-06) 



5.1.4 Clock CLK (contact C3) 



The terminal shall support 1 MHz to 5 MHz. The terminal shall supply the clock. No "internal clock" UICC shall be 
used. 

The duty cycle shall be between 40 % and 60 % of the period during stable operation. 

The terminal shall operate the UICC within the following limits. 

Table 5.3: Electrical characteristics of CLK under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


VOH 


loHmax = +20 mA 


0,7 X Vcc 


Vcc (see note) 


V 


Vol 


loLmax = "200 mA 


(see note) 


0,5 


V 


tRtp 


Cout = Cin = 30pF 




9 % of period with a 
maximum of 0,5 [xs 




NOTE: To allow for overshoot the voltage on CLK shall remain between -0,3 V and 
Vcc + 0,3 V during dynamic operation. 



5.1.5 I/O (contact C7) 

Table 5.4 defines the electrical characteristics of the I/O (contact C7). The values given in the table allow the derivation 
of the values of the pull-up resistor in the terminal and the impedance of the drivers and receivers in the terminal and 
UICC. 

Table 5.4: Electrical characteristics of I/O under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


V|H 


l|Hmax = ±20^A(seenote2) 


0,7 X Vcc 


Vcc + 0,3 


V 


V|L 


l|Lmax = +1 n^A 


-0,3 


0,15 X Vcc 


V 


Vqh (see note 1 ) 


loHmax = +20mA 


3,8 


Vcc 
(see note 3) 


V 


Vol 


'OLmax = "1 ^^ 


(see note 3) 


0,4 


V 


tRtp 


Cout = Cin = 30pF 




1 


MS 


NOTE 1 : It is assumed that a pull-up resistor is used in the interface device (recommended 

value: 20 kil). 
NOTE 2: During static conditions (idle state) only the positive value can apply. Under dynamic 

operating conditions (transmission) short-term voltage spikes on the I/O line may 

cause a current reversal. 
NOTE 3: To allow for overshoot the voltage on I/O shall remain between -0,3 V and Vcc + 0,3 V 

during dynamic operation. 



5.2 Class B operating conditions 
5.2.1 Supply voltage Vcc (contact CI ) 

The terminal shall operate the UICC within the following limits. 

Table 5.5: Electrical characteristics of Vcc under normal operating conditions 



Symbol 


Minimum 


Maximum 


Unit 


Vcc 


2,7 


3,3 


V 
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When the UICC is in idle state, the current consumption shall not exceed 200 |iA at 1 MHz at +25°C. When the UICC 
is in clock stop mode, the current consumption shall not exceed 100 |iA at +25°C. 

The terminal shall be capable of sourcing the maximum current as defined in table 6.4. It shall also be able to counteract 
spikes in the current consumption of the card up to a maximum charge of 12 nAs with no more than 400 ns duration and 
an amplitude of at most 60 mA, ensuring that the supply voltage stays in the specified range. 

5.2.2 Reset (RST) (contact C2) 

The terminal shall operate the UICC within the following limits. 

Table 5.6: Electrical characteristics of RESET (RST) under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


VOH 


loHmax = +20 mA 


0,8 X Vcc 


Vcc (see note) 


V 


Vol 


loLmax = -200MA 


(see note) 


0,2 X Vcc 


V 


tRtp 


Cjn = Gout = 30 pF 




400 


US 


NOTE: To allow for overshoot the voltage on RST should remain between -0,3 V and Vcc + 0,3 V 
during dynamic operations. 



5.2.3 Clock CLK (contact C3) 



The terminal shall support 1 MHz to 5 MHz. The terminal shall supply the clock. No "internal clock" UICC shall be 
used. 

The duty cycle shall be between 40 % and 60 % of the period during stable operation. 

The terminal shall operate the UICC within the following limits. 

Table 5.7: Electrical characteristics of Clock (CLK) under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


VoH 


lOHmax = +20 ^A 


0,7 X Vcc 


Vcc (see note) 


V 


Vol 


loLmax = "20 MA 


(see note) 


0,2 X Vcc 


V 


tRtp 


Gin = %ut = 30 PF 




50 


ns 


NOTE: To allow for overshoot the voltage on CLK should remain between -0,3 V and Vcc -i- 0,3 V 
during dynamic operations. 
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5.2.4 I/O (contact C7) 

Table 5.8 defines the electrical characteristics of the I/O (contact C7). The values given in the table allow the derivation 
of the values of the pull-up resistor in the terminal and the impedance of the drivers and receivers in the terminal and 
UICC. 

Table 5.8: Electrical characteristics of I/O under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


V|H 


'iHmax = *20 |iA (see note 2) 


0,7 X Vcc 


Vcc + 0,3 


V 


V|L 


l|Lmax = +1 n^A 


-0,3 


0,2 X Vcc 


V 


VOH 
(see note 1) 


loHmax = +20 mA 


0,7 X Vcc 


Vcc (see note 3) 


V 


Vol 


l0Lmax = -1n^A 


(see note 3) 


0,4 


V 


tRtp 


Cin = Co„ = 30pF 




1 


US 


NOTE 1 : It is assumed that a pull-up resistor is used on the interface device (recommended value: 

20 kil). 
NOTE 2: During static conditions (idle state) only the positive value can apply. Under dynamic operating 

conditions (transmissions) short-term voltage spikes on the I/O line may cause a current 

reversal. 
NOTE 3: To allow for overshoot the voltage on I/O shall remain between -0,3 V and Vcc + 0,3 V during 

dynamic operation. 



5.3 Class C operating conditions 
5.3.1 Supply voltage Vcc (contact C1 ) 

The terminal shall operate the UICC within the following limits. 

Table 5.9: Electrical characteristics of Vcc under normal operating conditions 



Symbol 


Minimum 


Maximum 


Unit 


Vcc 


1,62 


1,98 


V 



When the UICC is in idle state, the current consumption shall not exceed 200 |iA at 1 MHz at H-25°C. When the UICC 
is in clock stop mode, the current consumption shall not exceed 100 |iA at H-25°C. 

The terminal shall be capable of sourcing the maximum current as defined in table 6.4. It shall also be able to counteract 
spikes in the current consumption of the card up to a maximum charge of 12 nAs with no more than 400 ns duration and 
an amplitude of at most 60 mA, ensuring that the supply voltage stays in the specified range. 

5.3.2 Reset (RST) (contact C2) 

The terminal shall operate the UICC within the following limits. 

Table 5.10: Electrical characteristics of RESET (RST) under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


VoH 


lOHmax = +20 mA 


0,8 X Vcc 


Vcc (see note) 


V 


Vol 


loLmax = -200MA 


(see note) 


0,2 X Vcc 


V 


tRtp 


Cin = Cout = 30pF 




400 


US 


NOTE: To allow for overshoot the voltage on RST should remain between -0,3 V and Vcc + 0,3 V 
during dynamic operations. 
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5.3.3 Clock CLK (contact C3) 



The terminal shall support 1 MHz to 5 MHz. The terminal shall supply the clock. No "internal clock" UICC shall be 
used. 

The duty cycle shall be between 40 % and 60 % of the period during stable operation. 

The terminal shall operate the UICC within the following limits. 

Table 5.11 : Electrical characteristics of Clock (CLK) under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


VOH 


loHmax = +20 tiA 


0,7 X Vcc 


Vcc (see note) 


V 


Vol 


loLmax = "20 MA 


(see note) 


0,2 X Vcc 


V 


tRtp 


Gin = %ut = 30 PF 




50 


ns 


NOTE: To allow for overshoot the voltage on CLK should remain between -0,3 V and Vcc + 0,3 V 
during dynamic operations. 



5.3.4 I/O (contact C7) 

Table 5.12 defines the electrical characteristics of the I/O (contact C7). The values given in the table allow the 
derivation of the values of the pull-up resistor in the terminal and the impedance of the drivers and receivers in the 
terminal and UICC. 

Table 5.12: Electrical characteristics of I/O under normal operating conditions 



Symbol 


Conditions 


Minimum 


Maximum 


Unit 


V|H 


l|Hmax = ±20nA(seenote2) 


0,7 x Vcc 


Vcc -1- 0,3 


V 


V|L 


l|Lmax = +1 n^A 


-0,3 


0,2 X Vcc 


V 


VoH 
(see note 1) 


lOHmax = +20 MA 


0,7 X Vcc 


Vcc (see note 3) 


V 


Vol 


lOLmax^-ln^A 


(see note 3) 


0,3 


V 


tRtp 


Cin = Cout = 30pF 




1 


US 


NOTE 1 : It is assumed that a pull-up resistor is used on the interface device (recommended value: 

20 ka). 
NOTE 2: During static conditions (idle state) only the positive value can apply. Under dynamic operating 

conditions (transmissions) short-term voltage spikes on the I/O line may cause a current 

reversal. 
NOTE 3: To allow for overshoot the voltage on I/O shall remain between -0,3 V and Vcc + 0,3 V during 

dynamic operation. 



Initial communication establishment procedures 



6.1 



UICC activation and deactivation 



The terminal shall activate and deactivate the contacts of the UICC according to clause 4.4.2. During activation supply 
voltage switching, as defined in clause 6.2, shall take place prior to any further activity not related to the supply voltage 
switching. 
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6.2 Supply voltage switching 



The terminal shall initially activate the UICC with the lowest voltage class available. If no ATR is received, the UICC 
shall be deactivated and activated with the next higher class, if supported by the terminal. If an ATR is received at the 
first applied voltage class, the contents of the ATR shall be analysed by the terminal. If the operating class used by the 
terminal is not supported by the UICC, the terminal shall deactivate the UICC and activate it with a supply voltage class 
indicated by the UICC. If the ATR is corrupted, the terminal shall perform the procedure at least 3 times using the same 
operating class before rejecting the UICC. In case of 3 consecutive corrupted ATRs, the terminal may activate the 
UICC with the next higher class. The terminal is restricted not to use but the next higher class in the retrial attempt in 
this case. 

6.2.1 Supply voltage classes 

The supply voltage class shall be indicated in the ATR by the UICC (TAj, i > 2). 

Table 6.1 : Supply voltage classes indicated in ATR 



Symbol 


Minimum 


Maximum 


Unit 


Class 


Encoding 
(Binary) 


Vcc 


4,5 


5,5 


V 


A 


XX xxxl 


Vcc 


2,7 


3,3 


V 


B 


XX xxlx 


Vcc 


1,62 


1,98 


V 


C 


XX xlxx 


Vcc 


RFU 


RFU 


V 


D 


XX Ixxx 


Vcc 


RFU 


RFU 


V 


E 


xl xxxx 


NOTE: Class A and B values are according to ISO/IEC 7816-3 [11]. Class C 
and D are a further evolution of values specified in 
ISO/IEC 7816-3 [11]. It is possible to support a range of classes. The 
support shall be consecutive e.g. AB, BC. A combination like AC is not 
allowed. 



6.2.2 Power consumption of the UICC during ATR 

The maximum power consumption of the UICC during ATR is specified in tables 6.2a and 6.2b. The UICC power 
consumption during the ATR shall conform to the voltage class indicated in the ATR. If the UICC supports several 
supply voltage classes, each class shall conform to the corresponding maximum ATR power consumption, as specified 
in tables 6.2a and 6.2b. This is required because the terminal is not aware of the power consumption of the UICC until 
the ATR is received and an application is selected. 

Table 6.2a: Power consumption that applies during ATR at maximum external clock frequency 



Symbol 


Voltage 
Class 


Maximum 


Unit 


Ice 


A 


10 


mA 


Ice 


B 


7,5 


mA 


Ice 


C 


5 


mA 


Ice 


D 


RFU 


mA 


Ice 


E 


RFU 


mA 



Table 6.2b: Power consumption that applies during ATR at 4 MHz 



Symbol 


Voltage 
Class 


Maximum 


Unit 


Ice 


B 


6 


mA 


Ice 


C 


4 


mA 


Ice 


D 


RFU 


mA 


Ice 


E 


RFU 


mA 


NOTE: 4 MHz is the maximum clock speed 
specified in GSM for 3 V and below. 
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6.2.3 Application related electrical parameters 

The power consumption of a UICC depends upon the operating conditions and the application it is running. The power 
consumption of the UICC is restricted to the values indicated in tables 6.2a and 6.2b until an application is selected. An 
application is considered selected when the access condition is successfully verified. If no access condition is required 
for the application, the application is considered selected when an application related command is executed within the 
selected application. Selecting the application and performing a STATUS command is not considered to be the 
execution of an application command for these purposes. 

The terminal retrieves the application power consumption requirements by selecting the application. It then gets back 
the application power consumption indication in the response of the SELECT command. It may as well issue a 
STATUS command within the application and get this information in the response of the command. 

Table 6.3: Maximum power consumption of the UICC during the UICC session 



Symbol 


Voltage 
Class 


Maximum 


Unit 


Ice 


A 


60 


mA 


Ice 


B 


50 


mA 


Ice 


C 


30 


mA 


Ice 


D 


RFU 


mA 


Ice 


E 


RFU 


mA 


NOTE: All values assume the maximum external clock. 



Applications may specify their own maximum power consumption values, up to the maximum specified in table 6.3. 

If an application does not indicate its consumption, the terminal shall assume the maximum application power 
consumption is as specified in table 6.4. 

The minimum power supply that the terminal shall be able to supply to the UICC during application session at 
maximum clock speed is specified in table 6.4. 

Table 6.4: Minimum power supply by the terminal during the UICC session 



Symbol 


Voltage 
Class 


Minimum 


Unit 


Ice 


A 


10 


mA 


Ice 


B 


10 


mA 


Ice 


C 


10 


mA 


Ice 


D 


RFU 


mA 


Ice 


E 


RFU 


mA 


NOTE: All values assume the maximum external clock. 



6.3 



Answer To Reset content 



The ATR is the first string of bytes sent from the UICC to the terminal after a reset has been performed. The ATR is 
defined in ISO/IEC 7816-3 [11]. 

The terminal shall be able to receive interface characters for transmission protocols other than T=0 and T=l, historical 
bytes and a check byte, even if only T=0 and T=l are used by the terminal. 

T=15 global interface parameters shall be returned by the UICC. 

Example ATRs are listed in annex D of the present document. 
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6.3.1 Coding of historical bytes 



The historical bytes indicate to the external world how to use the card. The information carried by the historical bytes of 
the UICC follows ISO/IEC 7816-4 [12]. 

The category indicator is the first byte sent by the UICC. Its value shall be '80' which means that the historical bytes are 
coded in COMPACT-TLV data objects. 

The first information sent by the card shall be the "card data service" data object. This data object is introduced by 
tag '31'. The second information sent by the card shall be the "card capabilities" data object. This data object is 
introduced by tag '73'. The other data objects are optional. 



6.3.2 Speed enlnancement 



The terminal and the UICC shall at least support (F,D) = (512,8) and (512,16) in addition to (372,1), the default values. 
However, other values may also be supported. If the terminal requests PPS using values other than those above then the 
PPS procedure shall be initiated accordingly. The value of the transmission factors F and D is given by the UICC in 
TAjoftheATR. 



6.4 PPS procedure 



The terminal and the UICC shall support the PPS procedure in order to use transmission parameters other than the 
default values. The alternative parameters are indicated in the ATR. The interpretation of these parameters is according 
to ISO/IEC 7816-3 [11]. The terminal shall select a value within the range indicated by the UICC as defined in 
ISO/IEC 7816-3 [11]. 



6.5 Reset procedures 



Two types of resets are specified by the present document. Cold reset is the first reset occurring after activation of the 
contacts. Warm reset is any reset which is not a cold reset. 

6.5.1 Cold reset 

The cold reset is performed according to of ISO/IEC 7816-3 [11] and the UICC shall enter the negotiable mode. After a 
cold reset, the security status shall be reset. 

6.5.2 Warm reset 

The warm reset is performed according to of ISO/IEC 7816-3 [11] and the UICC shall enter either the negotiable or the 
specific mode. If the UICC enters the specific mode, it shall present the same protocol and interface parameters (Fi, Di) 
as in the session prior to the warm reset. The UICC shall respond with an identical ATR after every warm reset issued 
within the same session regardless of what application was active. After a warm reset, the security status shall be reset. 
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6.5.3 Reaction to resets 

A UICC complying with the present document shall either be a "Type 1 UICC" or a "Type 2 UICC". 
Figure 6. 1 illustrates how the respective types of a UICC react to the cold or warm reset. 

Warm Reset (Type 1 UICC) 

/ \ 

Cold Reset L^ ) Warm Reset (Type 1 UICC) 
(Type 1 UICC) X^ ^"\Jk'''' ~"~~---,/^ ^\ 
►/^ Negotiable ^ PPS procedure^ f Specific \ 

►! ^°'^^ J ^[ Mode j^ 

Cold Reset ^^ ^^^^-^_^-<^ 1 

(Type 2 UICC) Warm Reset (Type 2 UICC) V J 

Warm Reset (Type 2 UICC) 

Figure 6.1 : Reaction to resets 

See annex I for details. 




6.6 Clock stop mode 



The UICC shall support the clock stop procedure as defined in this clause. The clock stop mode is indicated in 

TAj (i > 2) in T=15 in the ATR, see ISO/IEC 7816-3 [11]. For a UICC supporting only class A operating conditions, 

clock stop mode "not allowed" may be indicated, see clause 6.3. If the UICC supports any other operating conditions 
even together with class A, clock stop mode shall be supported and the indication shall be set accordingly. The terminal 
shall follow this indication independently of operating conditions indicated by the card. 

The terminal shall wait at least 1 860 clock cycles after having received the last character, including the guard time 
(2 etu), of the response before it switches off the clock (if it is allowed to do so). It shall wait at least 744 clock cycles 
before it sends the first command after having started the clock. 

6.7 Bit/character duration and sampling time 

The bit/character duration and sampling time specified in ISO/IEC 7816-3 [11], clause 6.3.2 are valid for all 
communications. 



6.8 Error handling 



Following receipt of an ATR, which is not in accordance with the present document, e.g. because of forbidden ATR 
characters or too few bytes being transmitted, the terminal shall perform a Reset. The terminal shall not reject the UICC 
until at least three consecutive wrong ATRs are received. 

During the transmission of the ATR, the error detection and character repetition procedure specified in 

ISO/IEC 7816-3 [11], clause 6.3.3, is optional for the terminal. For the subsequent transmission on the basis of T=0 this 

procedure is mandatory for the terminal. 

For the UICC the error detection and character repetition procedure is mandatory for all communications using T=0. 
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6.9 Compatibility 



Terminals operating under class A operating conditions only and that are compliant to the electrical parameters defined 
in clause 5.1 shall operate with a 3 V Technology smart card according to the present document. 

For compatibility with existing terminals, UICCs that are used in applications where the supply voltage class indication 
is based on the STATUS response procedure (see clause 6.2.3) shall support this procedure in addition to the supply 
voltage class indication in the ATR as defined in the present document. 

In case the UICC does not support any supply voltage indication, the UICC shall be treated as a 5 V only card by the 
terminal. 



Transmission protocols 



This clause defines the transmission protocols used to exchange data between the terminal and the UICC. The structure 
and processing of commands initiated by the terminal for transmission control and for specific control in asynchronous 
half duplex transmission protocols will be described. 

Two different protocols are defined, the character based protocol T=0 and the block based protocol T=l. 

Both protocols T=0 and T=l are mandatory for the terminal. The UICC shall support either T=0 or T=l or both 
protocols. The protocols shall be supported as specified in the present document. 

The protocol starts after either the answer to reset or a successful PPS exchange. Other parameters provided in the ATR 
and relevant to a specific protocol are defined in the respective parts of this clause. 

The protocol applies a layering principle of the OSI-reference model. Four layers are considered. The layers are: 

• The physical layer. The contained definitions are valid for T=0 and T=l. 

• The data link layer, which consists of: 

a character component; 

a block component; 

block identification; 

send blocks; 

detect transmission and sequence errors; 

handle errors; 

synchronize the protocol. 

• The transport layer, which defines the transmission of application-oriented messages specific to each protocol. 

• The application layer, which defines the exchange of messages according to an application protocol that is 
common to both protocols. 
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Terminal 



UICC 
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USAT Layer 

Transport Layer 
Data link Layer 
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Application Layer 

USAT Layer 
Transport Layer 



Data link Layer 



Physical Layer 

2 



Figure 7.1 : Layers 



7.1 Physical layer 



Both protocols T=0 and T=l shall use the physical layer and character frame as defined in clause 7.2.1. 



7.2 Data link layer 



This clause describes the timing, specific options and error handling for the protocols T=0 and T=l. 

7.2.1 Character frame 

A character that is transmitted over the I/O line is embedded in a character frame. 

Before the transmission of a character, the I/O line shall be in state H. Depending upon the convention used, the logical 
'1' in a character is either represented by state H on the I/O line, direct convention, or state L on the I/O line, inverse 
convention. 

A character consists of 10 consecutive bits (see figure 7.2): 

• 1 start bit in state L; 

• 8 bits, which comprise the data byte; 

• 1 even parity checking bit. 

The parity bit is set, in a way, that there is an even number of bits set to '1' including the parity bit in the character 
frame. 

The time origin is fixed as the mean between the last observation of state H and the first observation of state L. The 
receiver shall confirm the existence of a start bit before 0,7 etu (receiver time). Then the subsequent bits shall be 
received at intervals of (n + 0,5 + 0,2) etu (n being the rank of the bit). The start bit is bit 1. 

Within a character, the time from the leading edge of the start bit to the trailing edge of the nth bit is (n + 0,2) etu. 

The interval between the leading edges of the start bits of two consecutive characters is comprised of the character 
duration (10 + 0,2) etu, plus a guardtime. Under error free transmission, during the guardtime both the UICC and the 
terminal shall be in reception mode (I/O line in state H). 
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Start 



Parity 



Start 



H 



I/O 



1 



■ 8 data bits 



Guardtime 



1 

in 



10±0,2etu 
■^ Character Duration 

Figure 7.2: Character frame 

The data shall always be passed over the I/O line with the most significant byte first. The order of bits within a byte 
(that is, whether the least significant or most significant bit is transferred first) is specified in character TS returned in 
the answer to reset (see ISO/IEC 7816-3 [11]). 

7.2.2 Transmission protocol T=0 

The T=0 is a half-duplex asynchronous character based transmission protocol. 

All commands using the protocol T=0 are initiated from the terminal by sending a five byte header, which informs the 
UICC what to do. The terminal will always act as master and the UICC as a slave. The direction of the transmission is 
assumed to be known to both the UICC and the terminal. 



7.2.2.1 



Timing and specific options for characters in T=0 



The minimum interval between the leading edge of the start bits of two consecutive characters shall be at least 12 etu. 

The maximum interval between the start leading edge of any character sent by the UICC and the start leading edge of 
the previous character sent either by the UICC or the terminal is the WWT. The value of the WWT shall not exceed 
960 X WI X Fi/f WI is an integer received in the specific interface byte TC2. If no TC2 is available, default value of WI 
is 10. The clock rate conversion factor, Fi, and the baud rate conversion factor Di, may be indicated in TAl . If TAl is 
absent the default values 372 and 1 respectively are used. 

If the WWT is exceeded, the terminal shall initiate a deactivation within 960 etu. 

The minimum interval between the leading edges of the start bits of two consecutive characters sent in opposite 
direction shall be 16 etu. 



7.2.2.2 



Command header 



A command is always initiated by the terminal which sends an instruction to the UICC in the form of a five byte-header 
called the command header. The command header is comprised of five consecutive bytes, CLA, INS, PI, P2, and P3. 

These bytes together with any data to be sent with the command form the Command Transport Protocol Data Unit 
(C-TPDU) for T=0. The mapping of the C-APDU onto the C-TPDU is described in clause 7.3. 

The terminal transmits the header to the UICC and waits for a procedure byte. 



7.2.2.3 



Command processing 



When the UICC has received the command header, a response containing a procedure byte shall be sent to the terminal. 
Both the terminal and the UICC shall be able to keep track of the direction of the data flow and who has the access to 
the I/O-line. 

7.2.2.3.1 Procedure bytes 

The procedure byte indicates to the terminal what action it shall take next. 

Procedure bytes are used to keep up the communication between the terminal and the UICC. They shall not be 
transmitted to the application layer. 
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The coding of the procedure byte and the action that shall be taken by the terminal is shown in table 7.1. 

Table 7.1 : Procedure byte coding 



Byte 


Value 


Action 


ACK 


Equal to INS byte 


All remaining data bytes shall be transferred by the terminal, or 
the terminal shall be ready to receive all remaining data bytes 
from the UICC. 


Equal to complement of INS byte 
(INS) 


The next data byte shall be transferred by the terminal, or the 
terminal shall be ready to receive the next data byte from the 
UICC. 


NULL 


'60' 


The NULL-byte requests no further data transfer and the 
terminal shall only wait for a character conveying a procedure 
byte. This behaviour provides additional work waiting time as 
defined in this clause. 


SW1 


'61' 


The terminal shall wait for a second procedure byte then send a 
GET RESPONSE command header to the UICC with a 
maximum length of 'XX', where 'XX' is the value of the second 
procedure byte {SW2). 


'6C' 


The terminal shall wait for a second procedure byte then 
immediately repeat the previous command header to the UICC 
using a length of 'XX', where 'XX' is the value of the second 
procedure byte {SW2). 



After these actions, the terminal shall wait for a further procedure byte or status word. 



7.2.2.3.2 



Status bytes 



The status bytes SWl SW2 form an end sequence indicating the status of the UICC at the end of a command. A normal 
ending of a command is indicating by SWl SW2 = '90 00'. 

Table 7.2: Status byte coding 



Byte 


Value 


Action 


SW1 


'6X' or '9X' (except '60', '61 ', and 
'6C') 


The terminal shall wait for a further status word (SW2). 
The terminal shall return the status words (together with any 
appropriate data) to the application layer and shall wait for 
another C-APDU. 



7.2.2.4 



Error detection and correction 



The error detection and correction procedure is mandatory for T=0 protocol except for the terminal during the 
ATR-procedure. 

An error, from the receiver's point of view, is defined by an incorrect parity. The error is indicated on the I/O line, 
which is set to state L at (10,5 + 0,2) etu after the leading edge of the start bit for the character. The I/O line shall be in 
state L for a maximum of 2 etu and a minimum of 1 etu. The transmitter shall check the I/O line for parity error 
indication at (1 1 + 0,2) etu starting from the leading edge of the start bit, in the character being transmitted. 

If the UICC or terminal as receiver detects a parity error in a character just received, it shall set the I/O line to state L at 
(10,5 + 0,2) etu after the leading edge of the start bit for the character for a maximum of 2 etu to indicate the error to the 
sender - see figure 7.2. 

If the transmitter detects an error indication at (11 + 0,2) etu starting from the leading edge of the start bit, in the 
character being transmitted, the character shall be sent again after a minimum delay of 2 etu. 
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7.2.3 Transmission protocol T=1 



The T=l protocol is a half-duplex asynchronous block based transmission protocol. The protocol may be initiated as 
follows: 

• after an ATR due to a cold reset; 

• after an ATR due to a warm reset; 

• after a successful PPS exchange. 

The communication starts with a block sent by the terminal to the UICC. The right to send a block keeps alternating 
between the terminal and the UICC. A block is the smallest data unit, which can be sent and can contain either 
application data or transmission control data. A check of the received data might be performed before further processing 
of the received data. 

7.2.3.1 Timing and specific options for blocks sent with T=1 

This clause defines options regarding timing, information file sizes and error detection parameters for blocks sent with 
T=l. 

7.2.3.1 .1 Information field size 

The IFSC defines the maximum length of the information field of blocks that can be received by the UICC. The default 
value of the IFSC is 32 bytes another value may be indicated in TA3 of the ATR. 

The IFSD defines the maximum length of the information field of blocks that the terminal can receive. IFSD has a 
default value of 32 bytes and may be adjusted during the card session. The maximum value of the IFSD is 254 bytes. 

7.2.3.1.2 Character waiting integer 

CWI is used to calculate CWT and shall be in the range from to 5. The value is set in bits b4 to bl in TB3. 

7.2.3.1 .3 Character waiting time 

CWT is defined as the maximum delay between the leading edges of two consecutive characters in the block. 



Figure 7.3: Character waiting time 

The value of CWT may be calculated from the following equation: CWT = (11+ 2*--*^) etu. 

7.2.3.1.4 Block waiting time 

B WT is defined as the maximum delay between the leading edge of the last character of the block received by the card 
and the leading edge of the first character of the next block sent by the card. 



<- Last character of a block sent by the 
terminal 



First character of next block sent by the UICC -> 
I BWT 



Figure 7.4: Blocit waiting time 

BWT is used to detect an unresponsive card. 
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7.2.3.1.5 



Block guard time 



BGT is defined as the minimum delay between the leading edge of two consecutive characters sent in opposite 
directions. The value of BGT shall be 22 etu. 



<- Last character of a block sent by the 
terminal 



First character of next block sent by the UICC -> 
I BGT 



Figure 7.5: Block guard time 

The delay between the last character of a block received by the UICC and the first character of the next block sent from 
the UICC shall be in the interval: 

• BGT < delay < BWT. 

7.2.3.1 .6 Waiting time extension 

WTX is a parameter used to ask for more time to process a command. 

7.2.3.1 .7 Error detection code 

The parameter TCi in the ATR is used to define which error detection code to use. LRC shall be used (bl=0). All other 
bits in TCi are RFU and shall be set to 0. 



7.2.3.2 



Block frame structure 



The protocol consists of blocks, which are transmitted between the terminal and the UICC. Each block has the 
following structure. 

Table 7.3: Block frame structure 



Prologue field 


Information field 


Epilogue field 


NAD 


PCB 


LEN 


INF 


EDC 


1 byte 


1 byte 


1 byte 


0-254 bytes 


1 byte 



The prologue field and the epilogue field are mandatory. The Information field is optional. 

7.2.3.2.1 Prologue field 

The prologue field is divided into the following three mandatory fields: 

• Node ADdress byte (NAD), 1 byte; 

• Protocol Control Byte (PCB), 1 byte; 

• LENgth (LEN), 1 byte. 



7.2.3.2.1.1 



Node address byte 



The NAD-byte identifies the source and the intended destination of the block. The NAD may also be used to distinguish 
between different logical connections if they coexist as well as to provide Vpp state control (bit b8 and b4). Since b8 
and b4 are not used, they shall be coded as '0'. Below is the structure of the NAD-byte. 

Table 7.4: Node address byte 



b8 


b7 1 b6 1 b5 


b4 


b3 1 b2 1 b1 


Unused 


DAD 


Unused 


SAD 
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In the first block sent from the terminal, a logical connection is set up based on the addresses in SAD and DAD. 
Subsequent blocks with an NAD containing the same pair of addresses are associated with the same logical connection. 

Only the default value SAD = DAD = shall be supported. All other combinations are RFU. 

7.2.3.2.1 .2 Protocol Control Byte 

All information needed to control the transmission is transferred in the protocol control byte PCB. The coding of the 
PCB-byte specifies the type of block. In the T=l protocol the following three different types of blocks are supported: 

• Information block (I-block): which is used to transfer command and response APDUs; 

• Receive-ready block (R-block): which is used to transfer acknowledgements; 

• Supervisory block (S-block): which is used to send control information. 

The tables below present the coding of the PCB-byte for each block-type, starting with the I-block. 

Table 7.5: Coding of PCB for an I-block 



b8 


b7 


b6 


b5 1 b4 1 b3 1 b2 | b1 





Sequence 

number, 

N(S) 


Chaining, 

more-data 

bit, M 


RFU 



Table 7.6: Coding of PCB for an R-block 



b8 


b7 


b6 


b5 


b4 1 b3 1 b2 1 b1 


1 








Sequence 
number N(R) 


See table 7.5 



Table 7.7: Bit b4 to b1 in the PCB-byte for the R-block 



b4 


b3 


b2 


b1 


Value 


Meaning 














'0' 


Error free 











1 


'1' 


EDC and/or parity error 








1 





'2' 


Other errors 


X 


X 


X 


X 


'X' 


Other values are RFU 



Table 7.8: Coding of PCB for an S-block 



b8 


b7 


b6 


b5 1 b4 1 b3 1 b2 | b1 


1 


1 


X 


See table 7.9 



Table 7.9: Bits b5 to b1 of PCB for an S-block 



b5 


b4 


b3 


b2 


b1 


Value 


Meaning 

















'0' 


Resynchronization 














1 


'1' 


Information field 











1 





'2' 


Abortion 











1 


1 


'3' 


Extension of BWT 








1 








'4' 


Error on VPP State (see note) 


X 


X 


X 


X 


X 


'X' 


Other values are RFU 


NOTE: Not used by UlCCs and terminals conforming to the present document. 



The coding of b6 indicates whether it is a request (b6 = 0) or a response (b6 = 1). 
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7.2.3.2.1.3 



Length 



The length byte codes the number of bytes in the Information field of the block. The number of bytes in the information 
field may vary in the range from byte to 254 bytes, depending on the type of block. 

The value LEN = '00' indicates that the information field is absent and the value 'FF' is RFU. 

7.2.3.2.1 .4 Information field 

The information field, INF, is optional and it depends on the type of the block what the field will be used for. 

Table 7.10: Information field 



Type of block 


INF used for 


l-block 


Transfer command and response APDUs. 


R-block 


Not used. 


S-block 


Transfers non application related information: 

• INF shall be present (single byte) to adjust 
IFS with WTX; 

• INF shall be absent to signal error on VPP, 
or managing chain abortion or 
resynchronization. 



7.2.3.2.2 



Epilogue field 



The epilogue field contains the Error Detection Code-byte (EDC), which transfers the error detection code of the 
transmitted block. 

The LRC as defined in ISO/IEC 7816-3 [1 1] shall be used. 

7.2.3.2.3 Block notations 

7.2.3.2.3.1 l-block 

The I-blocks are denoted as follows: I(N(S), M) where: 

• N(S) is the send-sequence number of the block; 

• M is the more-data bit used in the chaining function. 

7.2.3.2.3.2 R-block 

The R-block is denoted as follows: R(N(R)), where: 

• N(R) is the number of the expected I-block. 

7.2.3.2.3.3 S-block 

S-blocks are always used in pairs. An S(request) is always followed by an S(response) block. The S-blocks are denoted 
as follows: 

S(RESYNCH request), a request of a resynchronization; 

S(RESYNCH response), an acknowledge of the resynchronization; 

S(IFS request), an offering of a maximum size of the information field; 

S(IFS response), an acknowledge on the information field; 

S(ABORT request), a request to abort the chain function; 

S(ABORT response), an acknowledge of the abortion of the chain function; 
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• S(WTX request), a request for an extension of the waiting time; 

• S(WTX response), an acknowledge of the extension of the waiting time. 

7.2.3.3 Error free operation 

This clause describes the rules for error free operation with T=l. 

• The first block sent to the UICC shall be either an I-block with N(S) = or an S-block. 

• If a sender S sends I(Nj, (S), 0), the block is acknowledged by the receiver R with an I(Nj. (S), M). The contents 
of I(Nj. (S)) indicate data transfer data and that the receiver is ready to receive the next block from the sender. 

• If a sender S sends an I(Nj.(S), 1) it should be acknowledged by the receiver R with R(Nj.(R)), where 

Ng(S) i^ Nj.(R), to indicate that the received block was correct and that the receiver is ready to receive the next 
block. 

• The UICC might need more than BWT to process the previously received block, an S(WTX request) is sent by 
the UICC. The terminal shall acknowledge with an S(WTX response). The new allocated time starts at the 
leading edge of the last character of the S(WTX response). 

• To change the value of IFSD, the terminal sends an S(IFS request). The request shall be acknowledged by the 
UICC with an S(IFS response) with the same INF. The new IFSD is assumed to be valid as long as no new 
S(IFS request) has been received by the UICC. 

• When the receiver has received the number of characters as indicated in the value of the LEN and EDC the 
receiver returns the right to send. 

7.2.3.4 Error handling for T=1 

This clause contains a description of the rules used to control the error handling for the T= 1 protocol. 
The block component of the data link layer shall be able to handle errors like: 

• BWT time-out; 

• receive an invalid block, i.e. a block with parity errors, EDC error, invalid PCB, invalid length, lost 
synchronization or failure to receive relevant S(... response) after an S(... request). 

Resynchronization of the protocol may be attempted at three consecutive levels. If one level is unsuccessful, then the 
next level is tried. 

• For the terminal, the three levels are: 

Retransmission of blocks. 
Use of S(RESYNCH request). 
Card reset or deactivation. 

• For the UICC, the three levels are: 

Retransmission of blocks. 

Use of S(RESYNCH response). 

Without action by the terminal, the UICC becomes unresponsive. 

7.2.3.4.1 Protocol initialization 

After an ATR due to a Warm reset or successful PPS procedure, the communication between the terminal and the UICC 
can be initiated. But if the terminal fails to receive an error-free block, in the beginning of the protocol, a maximum of 
two more successive attempts to receive the block is allowed before resetting or a deactivation of the card takes place. 
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If the response on the first block sent by the terminal is not sent within BWT, the terminal shall send an R(0). 
When the protocol has been initiated and the first block received by the UICC is invalid, the UICC responses with an 

R(0). 

If the terminal fails to receive an error-free block during a card-session, a maximum of two further attempts is allowed 
before an S(RESYNCH request) is sent. 

7.2.3.4.2 Block dependent errors 

When an I-block has been sent and a BWT time-out occurs or an invalid block has been received (with the terminal), an 
R-block is sent, which requests with its N(R) for the expected I-block with N(S) = N(R). 

When an R-block was sent and an invalid block is received or BWT time-out, the R-block shall be resent. 

When an S(. . . request) has been sent and either a BWT time-out occurs (with the terminal) or the received response is 
not an S(... response), the S(... request) shall be resent. But if an S(... response) has been sent and either an invalid 
block is received or a BWT time-out occurs (with the terminal), an R-block shall be sent. The terminal shall not send an 
S(IFS request) before the R-block acknowledging a reception of the previous I-block sent by the card. 

When the UICC sends an S(IFS request) and receives an invalid block, the S(IFS request) shall be resent maximum one 
extra time to receive an S(IFS response). After the second failure to receive an S(IFS response), the UICC shall stay in 
reception mode. 

7.2.3.5 Chaining 

Chaining allows the terminal or the UICC to transfer information, which is longer than IFSC or IFSD. If information 
longer than IFSC or IFSD is transferred, the information should be divided into pieces, each has a length < IFSC or 
IFSD. Each piece should be sent in an I-block using the chaining function. 

The value of the M-bit in the PCB byte of the I-block controls the chaining function according to: 

• M = 0, the block is not chained to the next block; 

• M = 1, the block is chained to the next block, which shall be an I-block. 

When a receiver receives a more-data I-block, an R(N(R)) shall be sent. N(R) = N(S) of the expected I-block. At least 
one chained block should follow. 

A physical error, e.g. buffer overrun, in the UICC can cause an error in a chaining process. To abort a chain an 
S(ABORT request) can be sent by either the sender or the receiver. The request shall be answered with an S(ABORT 
response). When the S (ABORT response) has been received an R-block may be sent to either the terminal or the UICC 
to give back the right to send to either. 

7.2.3.5.1 Rules for chaining 

• When the terminal is the receiver, the terminal shall accept a sequence of chained I-blocks sent from the 
UICC. The length of each block is < IFSD. 

• When the UICC is the receiver, the UICC shall accept a sequence of chained I-blocks sent from the terminal. 
The length of each block shall be equal to the value of IFSC except for the last block whose length can be any 
value in the range of to IFSC. 

• When the terminal is the sender, all I-blocks of a chain shall have LEN = IFSC bytes except for the last, which 
could have a value in the range of to IFSC. 

• When the UICC is the sender, all I-blocks of a chain shall have LEN < IFSD bytes per block. 

• When the UICC is the receiver and receives block with LEN > IFSC, the block shall be rejected and 
acknowledged with an R-block with bits bl to b4 in the PCB-byte having a value of 2. 

For reasons of efficiency, it is not recommended to send empty I-blocks. 
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7.3 Transport layer 

This clause describes how the APDU are transported between the terminal and the UICC. For definition of the cases for 
Data in APDUs see clause 7.4. 

7.3.1 Transportation of an APDU using T=0 

This clause describes the mapping of C-APDUs and R- APDUs for T=0 protocol, the APDU exchange and the use of the 
GET RESPONSE command for case 2 and case 4. 



7.3.1.1 



Mapping of APDUs to TPDUs 



The mapping of the C-APDU onto the T=0 command header is dependent upon the case of the command. The mapping 
of the data (if present) and status returned by the UICC onto the R-APDU is dependent upon the length of the data 
returned. 

Procedure bytes '61XX' and '6CXX' are returned by the UICC to control exchanges between the transport layer of the 
terminal and the UICC, and should never be returned to the application layer of the terminal. Command processing in 
the UICC is not complete if it has returned procedure bytes '61 XX' or '6CXX'. 

Normal status on completion of processing a command is indicated if the UICC returns status words '9000' to the 
transport layer of the terminal. The transport layer of the terminal shall discontinue processing of a command (i.e. pass 
the R-APDU to the application layer and wait for a further C-APDU from the application layer) on receipt of any status 
words (but not on receipt of procedure bytes '61xx' and '6Cxx') from the UICC. For case 4 commands only, immediately 
following successful transmission of command data to the UICC, the transport layer of the terminal shall continue 
processing the command if warning status bytes ('62xx' or '63xx') or application related status bytes ('9xxx' except 
'9000') are received. 

The following descriptions of the mapping of data and status returned by the UICC onto the R-APDU are for 
information, and apply only after the UICC has completed processing of the command, successfully or otherwise, and 
all data (if present) has been returned by the UICC under the control of '61XX' and '6CXX' procedure bytes. Detailed 
use of the INS, INS, and '60' procedure bytes is not described. 

The status returned by the UICC shall relate to the most recently received command. Where a GET RESPONSE 
command is used to complete the processing of a case 2 or case 4 command, any status returned by the UICC after 
receipt of the GET RESPONSE command shall relate to GET RESPONSE command, not to the case 2 or case 4 
command which it completes. 

7.3.1.1.1 Casel 

The C-APDU is mapped onto the C-TPDU by assigning the value '00' to the body part (P3 = '00'). 

Application Layer (C-APDU) 
Transport Layer (C-TPDU) 

Transport Layer (R-TPDU) 
Application Layer (R-APDU) 

Figure 7.6 

The flow of the exchange is as follows: 

1) The transport layer of the terminal shall send the T=0 command header to the UICC. 

2) On receipt of the command header the UICC, under normal or abnormal processing, shall return status to the 
transport layer of the terminal. 

The UICC shall analyse the T=0 command header to determine whether it is processing a case 1 command or a 
case 2 command requesting all data up to the maximum length available. 
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3) On receipt of status from the UICC, the transport layer of the terminal shall discontinue processing of the 
command. 

See annex C for details of the exchanges between the transport layer of the terminal and the UICC. 

The status words returned to the transport layer of the terminal from the UICC after completion of processing of the 
command are mapped onto the mandatory trailer of the R-APDU without change. 

7.3.1.1.2 Case 2 

The C-APDU is mapped onto the C-TPDU without any change. 
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Figure 7.7 

The flow of the exchange is as follows: 

1) The transport layer of the terminal shall send the T=0 command header to the UICC. 

2) On receipt of the command header the UICC: 

a) under normal processing shall return data and status to the transport layer of the terminal. The UICC 
shall use procedure bytes '6Cxx' (and if required, procedure bytes '61xx') to control the return of data (see 
below); or 

b) under abnormal processing shall return status only to the transport layer of the terminal. 

3) On receipt of the data (if present) and status from the UICC, the transport layer of the terminal shall 
discontinue processing the command. 

See annex C for details of the exchanges between the transport layer of the terminal and the UICC, including use of the 
'61XX' and '6CXX' procedure bytes. 

The R-TPDU is mapped onto the R-APDU without any change. 

The data (if present) and status returned to the transport layer of the terminal from the UICC after completion of 
processing of the command are mapped onto the R-APDU as follows: 

• The data returned (if present) is mapped onto the conditional body of the R-APDU. If no data is returned, the 
conditional body of R-APDU is left empty. 

• The status returned is mapped onto the mandatory trailer of the R-APDU without change. 



7.3.1.1.3 Case 3 

The C-APDU is mapped onto the C-TPDU without any change. Lc is a value between 1 and 255. 
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Figure 7.8 





£75/ 



Release 5 



39 



ETSI TS 102 221 V5.4.0 (2003-06) 



The flow of the exchange is as follows: 

1) The transport layer of the terminal shall send the T=0 command header to the UICC. 

2) On receipt of the command header, if the UICC: 

a) returns a procedure byte, the transport layer of the terminal shall send the data portion of the conditional 
body of the C-APDU to the UICC under the control of procedure bytes returned by the UICC; or 

b) returns status, the transport layer of the terminal shall discontinue processing of the command. 

3) If processing was not discontinued in step 2(b), the UICC shall return status following receipt of the 
conditional body of the C-APDU and completion of processing the command. 

4) On receipt of status from the UICC, the transport layer of the terminal shall discontinue processing the 
command. 

See annex C for details of the exchanges between the transport layer of the terminal and the UICC. 

The status words returned to the transport layer of the terminal from the UICC after completion of processing of the 
command, or the status words returned by the UICC that caused the transport layer of the terminal to discontinue 
processing of the command, are mapped onto the R-APDU without change. 

7.3.1.1.4 Case 4 

The C-APDU is mapped onto the C-TPDU by cutting off the last byte (Le) of the body. 
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Figure 7.9 

The flow of the exchange is as follows: 

1) The transport layer of the terminal shall send the T=0 command header to the UICC. 

2) On receipt of the command header, if the UICC: 

a) returns a procedure byte, the transport layer of the terminal shall send the data portion of the conditional 
body of the C-APDU to the UICC under the control of procedure bytes returned by the UICC; or 

b) returns status, the transport layer of the terminal shall discontinue processing of the command. 

3) If processing was not discontinued in step 2(b), following receipt of the conditional body of the C-APDU, the 
UICC: 

a) under normal processing, shall return procedure bytes '61xx' to the transport layer of the terminal 
requesting the transport layer of the terminal to issue a GET RESPONSE command to retrieve the data 
from the UICC; or 

b) under abnormal processing, shall return status only to the transport layer of the terminal. 
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4) On receipt of the procedure bytes or status returned in step 3, if the UICC: 

a) returned '61xx' procedure bytes as in step 3(a), the transport layer of the terminal shall send a GET 
RESPONSE command header to the UICC with P3 set to a value less than or equal to the value 
contained in the 'xx' byte of '61xx' procedure bytes; or 

b) returned status as in step 3(b) that indicates a warning ('62xx' or '63xx'), or which is application related 
('9xxx' but not '9000'), the transport layer of the terminal shall send a GET RESPONSE command with 
Le = '00'; or 

c) returned status as in step 3(b) other than that described in step 4(b), the transport layer of the terminal 
shall discontinue processing of the command. 

5) If processing was not discontinued in step 4(c), the GET RESPONSE command shall be processed according 
to the rules for case 2 commands. 

The first R-TPDU from the UICC indicates that the UICC performed the command correct and that the UICC has more 
data of length Luicc bytes to transfer. The first R-TPDU is mapped without any changes onto the R-APDU. 

See annex C for details of the exchanges between the transport layer of the terminal and the UICC, including use of the 
'61XX' and '6CXX' procedure bytes. 

7.3.1.1.5 Use of procedure bytes '61 xx' and '6Cxx' 

The UICC returns procedure bytes '61xx 'and '6Cxx' to the transport layer of the terminal to indicate to it the manner in 
which it should retrieve the data requested by the command currently being processed. These procedure bytes are only 
used when processing case 2 and 4 commands using T=0. 

Procedure bytes '61xx' instruct the transport layer of the terminal to issue a GET RESPONSE command to the UICC. 
P3 of the GET RESPONSE command header is set to 'xx'. 

Procedure bytes '6Cxx' instruct the transport layer of the terminal to immediately resend the previous command header 
setting P3 = 'xx'. 

Usage of these procedure bytes during error free processing with case 2 and 4 commands is as follows. In the case of an 
error, the UICC may return status indicating error or warning conditions instead of the '61xx' or '6Cxx' response. 

7.3.1.1.5.1 Case 2 commands 

1) If the UICC receives a case 2 command header and Le = '00' (with Luicc < 256 bytes) or Le > Luicc, it shall 
return: 

a) procedure bytes '6C Luicc' instructing the transport layer of the terminal to immediately resend the 
command header with P3 = Luicc; or 

b) status indicating a warning or error condition (but not SWl SW2 = '90 00'). 

2) If the UICC receives a case 2 command header and Le = '00' (with Luicc = 256 bytes) or Le = Luicc, it shall 
return: 

a) data of length Le (= Luicc) under the control of the INS, INS, or '60' procedure bytes followed by the 
associated status; or 

b) procedure bytes '61xx' instructing the transport layer of the terminal to issue a GET RESPONSE 
command with a maximum length of 'xx', 'xx' being less than Luicc (this could happen if the card buffer 
size is smaller than Luicc); or 

c) status indicating a warning or error condition (but not SWl SW2 = '90 00'). 
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3) If the UICC receives a case 2 command header and Le < Luicc it shall return: 

a) data of length Le under the control of the INS, INS, or '60' procedure bytes followed by procedure bytes 
'61xx' instructing the transport layer of the terminal to issue a GET RESPONSE command with a 
maximum length of 'xx'; or 

b) status indicating a warning or error condition (but not SWl SW2 = '90 00'). 

7.3.1.1.5.2 Case 4 commands 

If the UICC receives a case 4 command, after processing the data sent with the C-APDU, it shall return: 

a) procedure bytes '61 xx' instructing the transport layer of the terminal to issue a GET RESPONSE command 
with a maximum length of 'xx'; or 

b) status indicating a warning or error condition (but not SWl SW2 = '90 00'). 

The GET RESPONSE command so issued is then treated as described for case 2 commands. 

7.3.2 Transportation of a APDU using T=1 

A C-APDU is sent from the application layer of the terminal to the transport layer of the terminal. The transport layer 
maps the C-APDU onto the INF of an I-block without change. The I-block is sent to the UICC. The Response data (if 
present) and the status are returned from the UICC to the transport layer of the terminal in the INF of an 
I-block. If the UICC returns a status which indicates: 

• normal processing ('6 IXX'); 

• a warning ('62XX' or '63XX'); 

• an application condition ('9XXX'); or 

• a successful execution of the command ('9000'); 

then it shall also return data (if available) associated with the processing of the command. No data shall be returned with 
any other status. 

The contents of the INF of the I-block are mapped onto the R-APDU without change and returned to the application 
layer of the terminal. The transportation of APDU messages with T=l is mapped to the information of an I-block 
according to the four different cases described below. Each case is described in detail in clauses 7.3.2.1 to 7.3.2.4. 

7.3.2.1 Case 1 

C-APDU is mapped to the INF of the I-block without any changes: 
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Figure 7.10 

The response received from the INF in the I-block is mapped unchanged to the R-APDU. 
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7.3.2.2 Case 2 

The C-APDU is mapped to the INF of an I-block without any changes. 
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Figure 7.11 





Transport Layer (R-TPDU, INF) 
Application Layer (R-APDU) 



The R-APDU consists of either the INF of the I-block or the concatenation of the INF of successive I-blocks all 
received in the same response, which all shall be chained. 



7.3.2.3 



Case 3 
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The C-APDU is mapped without any changes to either an INF or is concatenated onto several successive I-blocks, 
which all shall be chained. 

Application Layer (C-APDU) 
Transport Layer (C-TPDU, INF) 

Transport Layer (R-TPDU, INF) 
Application Layer (R-APDU) 

Figure 7.12 

The INF of the I-block is mapped to the R-APDU without any changes. 

7.3.2.4 Case 4 

The C-APDU is mapped without any changes to either an INF or is concatenated onto several successive I-blocks, 
which all shall be chained. 
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Figure 7.13 





UICC 



Command Processing 



Le byte of DATA||SW1 ||SW2 



The response consists of either the INF of an I-block received in the response or the concatenation of INF of successive 
I-blocks in response, which all shall be chained. 



7.4 Application layer 



The application protocol consists of an ordered set of exchanges between the application layer and the transport layer of 
the terminal. Application protocols are defined in subsequent parts of the present document. 

Each step in an application layer exchange consists of a command-response pair, where the application layer of the 
terminal sends a command to the UICC via the transport layer of the terminal, and the UICC processes it and sends a 
response to application layer of terminal using the transport layer of the UICC and the transport layer of terminal. Each 
specific command (C-APDU) has a specific response (R-APDU). The commands and responses are called command 
messages and response messages. The structure of the C-APDU can be found in clause 10.2. The structure of the 
R-APDU can be found in clause 10.3. 
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Both command and response messages may contain data. Thus, four cases shall be managed by the transmission 
protocols via the transport layer, as shown in table 7.1 1. 

Table 7.11 : Definition of cases for data in APDUs 



Case 


Command data 


Response data 


1 


Absent 


Absent 


2 


Absent 


Present 


3 


Present 


Absent 


4 


Present 


Present 



7.4.1 Exchange of APDUs 

Figure 7.14 shows the principle exchange of command/response pairs. 
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Figure 7.14 

7.4.2 CAT layer 

The CAT layer uses application status words to indicate: 

• the availability of a proactive command for the terminal ('91 XX'); 

• the usage of response data to an envelope command by the terminal (nominal '9000', warning '62XX' or 

'63XX'); 

• the temporary unavailability of the CAT to handle an envelope command ('9300'), see clause 11.6.6. 



7.4.2.1 



Proactive command 



Where the status word SW1-SW2 is equal to '9000', the card can reply '91XX' to indicate that a proactive command is 
pending. The terminal uses the FETCH C-APDU to get the pending proactive command. The terminal sends to the 
UICC the response of the proactive command execution with the TERMINAL RESPONSE C-APDU. 

The mechanism, described hereafter for a case 4 C-APDU, is independent from the transport protocol. 
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Figure 7.15 
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7.4.2.2 



ENVELOPE Commands 



The ENVELOPE C-APDU is used to transmit data to the CAT. For some BER-TLV (e.g. SMS-PP Data Download) 
contained in the body of this command, the card may send back data to be transmitted by the terminal on the 
acknowledgement channel (e.g. RP-ACK) or on the error channel (e.g. RP-ERROR). The BER-TLV objects are defined 
in TS 102 223 [4] and in access technology dependent specifications. 

This command is case 4 and is described hereafter for the two options. 

Case 4: positive acknowledgement 
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Figure 7.16a 



The terminal shall consider the data field received as a positive acknowledgement and use the normal acknowledgement 
channel (e.g. RP-ACK) when the status word present in the R-APDU is '9000'. 



Case 4: 



negative acknowledgement 
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Figure 7.16b 

The terminal shall consider the data field received as a negative acknowledgement and use the error acknowledgement 
channel (e.g. RP-ERROR), when the status word present in the R-APDU is either '62XX' or '63XX'. 
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8 Application and file structure 

This clause describes the application and logical structure for the UICC. 

8.1 UICC application structure 

An example of organization of applications in the UICC is listed in figure 8.1. 




Figure 8.1 : Example of an application structure 

The present document does not impose any restrictions on the location of applications. All applications are uniquely 
identified by application identifiers that are obtained from EF^jj^. These application identifiers are used to select the 
application. 

EFqjj^ EFpL and EF^qqjj-^ are all mandatory and reside directly under the Master File. See clause 13 of the present 
document for details. 

'-^Ptelecom i^ optional. If present it resides under the MF and use the reserved FID '7F 10'. DF-j-gL£(-;Q]y[ contains 
application independent information. 

8.2 File types 

This clause defines the file types that apply to applications complying to the present document. 

8.2.1 Dedicated files 

A Dedicated File (DF) allows for a functional grouping of files. It can be the parent of DFs and/or EFs. DFs are 
referenced by file identifiers. 

An Application DF (ADF) is a particular DF that contains all the DFs and EFs of an application. 
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8.2.2 Elementary files 

8.2.2.1 Transparent EF 

An EF with a transparent structure consists of a sequence of bytes. When reading or updating, the sequence of bytes to 
be acted upon is referenced by a relative address (offset), which indicates the start position (in bytes), and the number of 
bytes to be read or updated. The first byte of a transparent EF has the relative address '00 00'. The data length is 
indicated in the SELECT response of the EF. 

8.2.2.2 Linear fixed EF 

An EF with linear fixed structure consists of a sequence of records all having the same (fixed) length. The first record is 
record number 1 . The length of a record as well as this value multiplied by the number of records are indicated in the 
SELECT response of the EF. 





Record 1 


Record 2 




Record n 



Figure 8.2: Structure of a linear fixed file 

There are several methods to access records within an EF of this type: 

• absolutely using the record number; 

• when the record pointer is not set it shall be possible to perform an action on the first or the last record by 
using the NEXT or PREVIOUS mode; 

• when the record pointer is set it shall be possible to perform an action on this record, the next record (unless 
the record pointer is set to the last record) or the previous record (unless the record pointer is set to the first 
record); 

• by identifying a record using pattern search. 

If an action following selection of a record is aborted (e.g. due to an unsuccessful execution of a command), then the 
record pointer shall remain set at the record at which it was set prior to the action. 

It is not possible, at present, to have more than 254 records in a file of this type, and each record cannot be greater than 
255 bytes. 

8.2.2.3 Cyclic EF 

Cyclic files are used for storing records in chronological order. When all records have been used for storage, then the 
next storage of data shall overwrite the oldest information. 

An EF with a cyclic structure consists of a fixed number of records with the same (fixed) length. In this file structure 
there is a link between the last record (n) and the first record. When the record pointer is set to the last record n, then the 
next record is record L Similarly, when the record pointer is set to record 1, then the previous record is record n. The 
last updated record containing the newest data is record number 1, and the oldest data is held in record number n. 
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Record 1 


Record 2 




Record n 



Figure 8.3: Structure of a cyclic file 

For update operations only PREVIOUS record shall be used. For reading operations, the methods of addressing are 
Next, Previous, Current and Record Number. 

If an action following selection of a record is aborted (e.g. due to an unsuccessful execution of a command), then the 
record pointer shall remain set at the record at which it was set prior to the action. 

It is not possible, at present, to have more than 254 records in a file of this type, and each record cannot be greater than 
254 bytes. 



8.3 File referencing 



A File IDentifier (FID) is used to address or identify a specific file. The FID consists of two bytes and shall be coded in 
hexadecimal notation. 

FIDs shall be subject to the following conditions: 

• the FID shall be assigned at the time of creation of the file concerned; 

• no two files under the same parent shall have the same ID; 

• the immediate children of the current DF, the parent DF or the immediate children of the parent DF shall not 
have the same FID. 

A path is a concatenation of FIDs. The path starts from MF or the current DF, and ends with the identifier of the file 
itself. The order of the FIDs is always in the direction from father to child. 

A Short File Identifier (SFI) is coded as 5 bits valued in the range from 1 to 30. No two files under the same parent shall 
have the same SFI. 

A DF name is coded on 1 to 16 bytes. The DF name is the AID and shall be unique within a card. 

The reserved FID '7FFF' can be used as a FID for the ADF of the current active application on a given logical channel. 

8.4 IVIethods for selecting a file 

After the UICC activation (as defined in clause 6.1) and the Answer To Reset (ATR), the Master File (MF) is implicitly 
selected and becomes the current directory. Each file may then be selected by using the SELECT function, using one of 
the 3 file referencing methods defined in this clause. 

8.4.1 SELECT by File IDentifier referencing 

Selecting a DF, an ADF or the MF sets the current directory. After such a selection there is no current EF. Selecting an 
EF sets the current EF and the current directory remains the DF, ADF or MF, which is the parent of this EF. The current 
EF is always a child of the current directory. Only the ADF of the current application can be selected by FID. 

Any application specific command shall only be operable if it is specific to the Current Directory. 
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The following files may be selected, by File IDentifier (FID) referencing, from the last selected file: 

• any file which is an immediate child of the current directory; 

• any DP which is an immediate child of the parent of the current DF; 

• the parent of the current directory; 

• the current DF; 

• the ADF of the current active application; 

• the MF. 

Figure 8.4 is an example of the logical structure for an application conforming to the present document. 



MF 



EF-DIR 



EF1 




ADF1 



DF3 



EF3 



DF4 



DF5 



EF4 



EF5 



EF6 



EF7 



Figure 8.4: Example of a logical structure 

Table 8.1 gives all the valid selections for an application complying to the present document for the logical structure in 
figure 8.4, if the FID is used. Reselection of the last selected file is also allowed but not shown. In this example, it is 
considered that the current application (ADFl) has been previously selected by DF name. Therefore ADFlcan be 
selected by using the FID '7FFF'. 
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Table 8.1 : File selection 



Last selected file 


Valid selections 


MF 


ADF1, DF1, EF1, EF-DIR 


DF1 


MF, ADF1, EF2, 


ADF1 


MF, DF3, DF4, EF3 


DF3 


MF, ADF1, DF4, DF5, EF4 


DF4 


MF, ADF1, DF3, EF5, EF6 


DF5 


MF, ADF1, DF3, EF7 


EF1 


MF, ADF1, DF1, EF-DIR 


EF2 


MF, ADF1, DF1 


EF3 


MF, ADF1, DF3, DF4 


EF4 


MF, ADF1, DF3, DF4, DF5, 


EF5 


MF, ADF1, DF3, DF4, EF6 


EF6 


MF, ADF1, DF3, DF4, EF5 


EF7 


MF, ADF1, DF3, DF5 



8.4.2 SELECT by path referencing 

A file, DF or EF, may be referenced by path, as defined in clause 8.3. Table 8.2 contains examples of selection by path 
from figure 8.4. In this example, it is considered that the current application (ADFl) has been previously selected by DF 
name. The implicit FID of ADFl '7FFF' is used in table 8.2 (see clause 8.3). 

Table 8.2: Examples of file selection by path 



Last selected DF 


Beginning of the path 


Example selections 


any 


MF 


'EF1', 'EF-DIR', 'DF1','DF1||EF2' 


any 


MF 


'7FFF||DF3', '7FFF||DF3||EF4', 
'7FFF||DF3||DF5', '7FFF||DF3||DF5||EF7' 
'7FFF||DF4', '7FFF ||DF4||EF5', 
'7FFF||DF4||EF6, 
'7FFF||EF3' 


DF1 


Current DF 


'EF2' 


DF3 


Current DF 


'DF5', 'DF5||EF7', 'EF4' 


DF4 


Current DF 


'EF5', 'EF6' 


DF5 


Current DF 


'EF7' 



In the case of "select by path from MF", the terminal may use the special file-id '7FFF' (see clause 8.3) at the beginning 
of the path. It indicates that the path begins at the ADF of the current active application on this logical channel. 

The following restriction apply: 

• In the case of "select by path from MF", the terminal shall not use the file identity of the MF (i.e. '3F00') at the 
beginning of the path. 

• In the case of "select by path from current DF", the terminal shall not use the special file-ID '7FFF' at the 
beginning of the path. 

• In the case of "select by path from MF" or "select by path from current DF", the terminal shall not use the file 
identity of the current DF. 

• In the case of "select by path from MF" or "select by path from current DF", the terminal shall not use an 
empty data field. 

8.4.3 Short File Identifier 

Any EF within a DF can be implicitly selected without giving a SELECT command by applying one of the following 
commands at the DF or ADF level and giving a Short File Identifier (SFI) as a part of the command: 

• READ BINARY; 

• UPDATE BINARY; 
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• READ RECORD; 

• UPDATE RECORD; 

• INCREASE; or 

• SEARCH RECORD. 

Support of SFI for a specific file is indicated if the FCP of the file contains a TLV DO with tag '88'. If the length is it 
indicates that the file does not support referencing by SFI. If the TLV DO is not present in the FCP it indicates that the 
5 least significant bits of the FID are used as SFI. 

When the READ RECORD command contains a valid SFI, it sets the file as the current EF and resets the current record 
pointer. Subsequent records are read with the READ RECORD command without SFI. 

When the UPDATE RECORD command contains a valid SFI, it sets the file as the current EF and resets the current 
record pointer. Subsequent records are updated with the UPDATE RECORD command without SFI. 

When the INCREASE command contains a valid SFI, it sets the file as the current EF and resets the current record 
pointer. Subsequent records are increased with the INCREASE command without SFI. 

When the SEARCH RECORD command contains a valid SFI, it sets the file as the current EF and resets the current 
record pointer. Subsequent records are searched with the SEARCH RECORD command without SFI. 

8.5 Application characteristics 

An application may be either explicitly or implicitly referenced. 

An application is activated by explicit selecting it with the AID. This sets the application's ADF as the current ADF. 

A current ADF can be referenced by FID with the implicit reference value '7FFF'. 

8.5.1 Explicit application selection 

8.5.1.1 SELECT by DF name 

A selectable application, represented in the UICC by the AID, shall be referenced by a DF name coded on 1 to 16 bytes. 
Each name shall be unique within a UICC. A DF name can be used in the SELECT command to select a selectable 
application. 

8.5.1 .2 SELECT by partial DF name 

A selectable application can also be selected using a partial DF name (when PI = '04') using the P2 parameters first and 
only occurrence, next, previous or last as defined in ISO/IEC 7816-4 [12]. In this case, the DF name is right truncated. 
If several applications starting with the same byte content in the AID are present on the card, the application selected is 
depending upon the value specified in P2. If the "last" option is indicated in P2, the selected application is the last active 
application matching the partial DF name, even if it was during a previous card session. 

Selection of an application using a partial DF name is optional for mono application cards, but a multi application card 
shall support it. The card shall indicate the support of this feature in the "card service data" and the "card capabilities" 
compact-TLV objects of the ATR historical bytes as specified in ISO/IEC 7816-4 [12]. 

The interpretation of next, previous and first is to be specified by the application. The application that is selected using 
these parameters shall match the partial DF name provided in the SELECT command. If the UICC does not support 
selection with partial DF name, the UICC shall respond with an appropriate response (e.g. command parameters not 
supported '6A86'). 

8.5.2 Application session activation 

The application session is initiated when the terminal sends a SELECT command, with the application's AID, indicating 
in the command parameters that the application shall be activated. 



£75/ 



Releases 51 ETSI TS 1 02 221 V5.4.0 (2003-06) 

An application may need an initialization procedure to be performed after its activation. This procedure is outside the 
scope of the present document but shall be described in the application specification. The procedure is used to bring the 
terminal and the application in the UICC to a well-defmed state. 

After having selected the application the UICC evaluates the security environment for this application. The SE is set 
according to the verification requirements for the application see table 9.1. 

The verification status of the application PIN is updated according to the application's session activation procedure, as 
specified by the application. 

The terminal may send to the UICC a specific STATUS command indicating that the initialization procedure of the 
application has been successfully executed. 

There can only be one active selectable application session on a given logical channel. Therefore, in order to activate a 
new selectable application session in parallel to another, a new logical channel shall be opened. 

A selectable application session may take place on several channel sessions. 

8.5.3 Application session termination 

An application may have a session termination procedure to be performed before the application is terminated. This 
procedure shall be described in the application specification. Before this procedure is executed, the terminal may send 
to the UICC a specific STATUS command indicating that the termination procedure of the application will start. After 
this termination procedure has been executed the terminal and the application are in a well-defined state. 

An application session is then terminated if any of the following events occur on each logical channel that the 
application session has been activated on: 

• implicitly; if a SELECT by DF name command with an AID different from the currently active application is 
performed by the UICC, indicating in the command parameters that this new application shall be activated; 

• explicitly; if the application is reselected using the SELECT by DF name command with the AID 
corresponding to the currently active application, and indicating in the command parameters that the 
application shall be closed; 

NOTE: The currently selected DF on the logical channel after application termination is not defined in this 

release of the specification. Therefore, no specific behaviour from the card should be expected by the 
terminal. 

• if the logical channel is closed. 

An application session is also terminated when the terminal performs a reset of the UICC. 

The verification status of the application PIN is updated according to the application's session termination procedure, as 
specified by the application. 

8.5.4 Application session reset 

An application is reset if the application is reselected using the SELECT by DF name command with the AID 
corresponding to the currently active application, indicating in the command parameters that the application shall be 
activated. 

Reset initializes the application session activation procedure. The security status of the application is updated according 
to the application's session activation procedure, as specified by the application. 

8.5.5 GSM/USIM application interaction and restrictions 

Activation of a USIM session excludes the activation of a GSM session. In particular, this implies that once a USIM 
application session has been activated, commands sent to the UICC with CLAss byte set to 'AO' shall return SW1SW2 
'6E 00' (class not supported) to the terminal. 

Similarly, activation of a GSM session excludes the activation of a USIM session. 
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At most one USIM session can be active at the same time. 

8.6 Reservation of file IDs 

The following FIDs are reserved by the present document: 

• ADF: 

operational use (implicit FID for the current ADF): 
'7FFF' 

• Dedicated Files: 

administrative use: 

7F4X', '5F1X', '5F2X'. 
operational use: 

■ 7F10' (DFtelecom)' '7F20' (DF^s^,), 7F2r (DF^csisoo)' '7F22' (DF^^.^.X 7F23' (DFpp.cxs), 
7F24' (DF-j-j^ypj^.j3g.), 7F25' (DFtia/EIA-95') '^^'^ 7F2X', where X ranges from '6' to 'F'. 

NOTE: 7F80' (DEpp^) is used for the Japanese PDC specification. 
7F90' (DFjg-pjj^) is used for the TETRA specification. 
7F3r (DFjQgj^) is used in the iDEN specification. 

reserved under 7F10': 

'5F50' (DFqraphics); '5F3A' (DFpjjonebook)- 

• Elementary files: 

administrative use: 

'6F XX' in the DFs 7F 4X'; '4F XX' in the DFs '5F IX', '5F2X'. 

'6F IX' in the DFs 7F 10', 7F 20', 7F 21'; 

'4F IX' in all 2"^ level DFs. 

'2F EX' in the MF '3F 00'; 
operational use: 

'6F 2X', '6F 3X', '6F 4X' in 7F 10' and 7F 2X'; 

■ '4F YX', where Y ranges from '2' to 'F' in all 2"'^ level DFs. 
'2F05', '2F06' and '2F IX' in the MF '3F 00'. 

operational use ISO/lEC 78 1 6-4 [ 1 2] : 

'2F00' EFpiR, '2F0 1 ' EF^tr in the MF '3F00'. 
In all the above, X ranges, unless otherwise stated, from '0' to 'F'. 



8.7 Logical channels 



Logical channels are defined in ISO/IEC 7816-4 [12]. There may be up to 3 logical channels in addition to the basic 
logical channel 0. Channel is always available and open throughout the card session. 
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A UICC which supports logical channels indicates it in the ATR, together with the assignment methods and maximum 
number of logical channels it supports. The UICC supporting logical channels shall support: 

• at least one channel in addition to the basic channel; and 

• logical channel number assignment by the UICC. 

Command interdependencies on one logical channel are independent of command interdependencies on another logical 
channel. 

There is no interleaving of commands and their responses across logical channels; between the receipt of the command 
APDU and the sending of the response APDU to that command, only one logical channel is active. 

In order to be accessed from several logical channels at the same time, a given file (EF, DF, ADF) shall be indicated as 
"shareable" in its file descriptor. 

File access should be managed independently on each opened logical channel. In particular, a record-based file shall 
have a different record pointer for each opened logical channel. 

Applications are responsible for keeping data consistency (in the card and the terminal) when accessing the same file 
from different logical channels. 

NOTE: Special attention should be given to cyclic files, e.g. when the file is read in one channel and updated in 
another. 

A logical channel is opened by using a MANAGE CHANNEL command, in which the card assigns a channel number 
and returns it in the response. 

The logical channel remains open until it is explicitly closed by a MANAGE CHANNEL command, or if the UICC is 
deactivated. 

When the open function is performed from the basic channel, then after a successful open, the MF shall be implicitly 
selected as the current DF. When the open function is performed from a logical channel which is not the basic one, then 
after a successful open, the current DF of the logical channel from which the command was issued shall be selected as 
the current DF. In both cases, no current EF is selected in the new logical channel. 



Parameters of the 

MANAGE CHANNEL 

command 


Characteristics of the new channel 


Current DF 


ADF of current active application 
(referred to by the special '7FFF' file-ID) 


CLA=00 
(from the basic channel) 


MF 


Undefined 


CLA^OO 

(from the non-basic 

channel) 


The same current DF as the one 
where the open channel is performed 


ADF the application active in the logical channel 
where the open channel was performed 



Once a new channel is opened, the current DF and the current file are independent per each logical channel. 

If the MANAGE CHANNEL command is performed on a DF or ADF that is not shareable, the card shall respond with 
an appropriate error message. The response shall indicate that the command is not allowed. No new channel is opened. 



Security features 



Every application that conforms to the present document may define security features in addition to the mandatory 
features defined in this clause. 



9.1 Supported security features 



A terminal that conforms to the present document and is designed for a multi-application UICC shall recognize the 
security attribute tags specified in the present document. 

A single application terminal conforming to the present document shall support one of the access rules format specified 
in the present document. The application specifies which format is used. 
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A multi-application capable terminal that is designed to support a multi-verification capable UICC shall, from the 
security context point of view, support the usage of the level 1 verification requirements (PIN) and the level 2 
verification requirements (PIN2). The coding is defined in table 9.3. The terminal shall, in addition, support the usage of 
a universal PIN as defined in the present document. 

A multi-verification capable UICC conforming to the present document shall, from the security context point of view, 
support more than one level 1 user verification requirement (PIN). The specific key reference for the level 1 PIN is 
specified by each application in accordance with table 9.3. In addition, the application may specify a level 2 user 
verification requirement (PIN2). A multi-verification capable UICC shall support the use of a universal PIN. A 
multi -verification capable UICC shall support access rules defined in security attributes indicated in tag '8B' 
(i.e. referenced to expanded format). 

A single verification capable UICC shall, from the security context point of view, support one level 1 user verification 
requirement (PIN) as defined in table 9.3. In addition the application may specify a level 2 user verification requirement 
as a second application verification requirement (PIN2). A single verification capable UICC may contain one or more 
selectable applications if there are no security aspects to be considered between the different selectable applications. 
From the security point of view only one level 1 verification requirement (PIN) is assigned to all ADFs/DFs and files on 
the UICC. In addition, a level 2 user verification requirement (PIN2) may be assigned for each application. From the 
security and access rules point of view the UICC is seen as a single application card. The coding of the level 1 and 
level 2 user verification requirement shall be according to table 9.3. 



9.2 Security architecture 



An application on a UICC conforming to the present document shall specify a level 1 key reference as the user 
verification (PIN). In addition the application may specify a level 2 key reference as a second user verification 
requirement (PIN2). The coding of the level 1 and level 2 user verification requirement shall be according to table 9.3. 
In addition, an application may specify the usage of a universal PIN as a replacement for the application PIN. 

In order to perform commands other than SELECT and STATUS/GET RESPONSE, the security condition for the file 
shall be met. A security condition data object contains the conditions to be met in order to perform certain commands 
on a selected ADF/DF/EF. 

If the UICC can not determine the access condition for the requested access to a file, then the requested access to this 
file shall not be granted and the card shall return an error Status Word '6982' (Security status not satisfied). 

The security architecture consists of the following parts: 

• Security attributes: a set of access rules. 

• Access rules: consist of an access mode and one or more security conditions. 

• Access Mode (AM): indicates to which operations (commands) the security condition applies. 

• Security Condition (SC): contains references to the applicable key references (PINs). 
The following clauses define the parts constituting the security architecture. 

9.2.1 Security attributes 

The security attributes are attached to an ADF/DF/EF and they are part of the FCP. The security attributes are indicated 
in the FCP using tag 'SB', tag '8C' or tag 'AB' depending upon the format used, see ISO/IEC 7816-9 [16]. 

9.2.2 Access mode 

The access mode byte/data object (AM byte/AM_DO) defines for which group/type of command(s) the security 
condition apply. The interpretation of the AM byte/AM_DO is file dependent (i.e. different for a DF/ADF and an EF), 
see ISO/IEC 7816-9 [16]. The command type/group is defined and coded according to ISO/IEC 7816-9 [16]. 

For instructions not belonging to a group as defined in ISO/IEC 7816-9 [16] the access rights can be indicated using 
AM_DO tags '81' - '8F'. The value of the tag defining the AM_DO indicates what description of the command exists in 
the definition list to follow in the value part of the data object. The coding of bit b4 to bl in the AM_DO tag is defined 
in ISO/IEC 7816-9 [16]. 
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The security conditions for bits not set to '1' in the AM byte are set to NEVer by default. 

9.2.3 Security condition 

The Security Condition (SC) indicates which security related procedures (user PIN verification) shall be satisfied before 
a command may be performed on a file. The SC is coded according to ISO/IEC 7816-9 [16]. 

9.2.4 Access rules 

The access rule defines the security conditions for access to a file for each command/command group indicated in the 
AM-byte/AM_DO. The security condition is indicated in the SC-byte(s)/SC_DO(s) following the AM-byte/AM_DO. 
The access rule is coded by using one ore more AM-bytes/AM_DOs each followed by one or more security conditions 
that are to be satisfied for the appropriate access. 

The access rules may be coded in a compact or an expanded format. Furthermore, it is possible to combine one or more 
SCs to one AM such that at least one SC (the OR relation) shall be fulfilled before the command can be executed. It is 
possible to combine the SC such that more than one SC has to be fulfilled (the AND relation). 

An access rule is a set of requirement(s) that shall be met in order to perform operations on a file. An access rule 
contains one or more security attributes, the AM byte/AM_DO in the attribute indicates what commands can be 
performed and the SC byte/SC_DO indicates what SC shall be met to be able to perform the commands indicated in the 
AM byte/AM_DO. The content of each AM byte (in compact format) or AM_DO (in expanded format) shall be unique 
within the same access rule. SC_DOs OR and AND relations shall contain at least two access conditions. The terminal 
shall ignore an AM/SC combination which is syntactically incorrect or with unknown instructions. 

The CRT tags for SC_DOs are defined in ISO/IEC 7816-9 [16]. The SC required to perform commands indicated in the 
AM byte/AM_DO may be a simple condition or a logical OR or AND condition of several SC_DOs. The constructed 
TLV object containing AM bytes/ AM_DOs and SC bytes/SC_DOs is an access rule. An access rule can be indicated in 
the FCP in one of the following ways: 

• Tag '8C' Security attributes, compact format; 

• Tag 'AB' Security attributes expanded format; 

• Tag '8B' Security attributes. Referenced to expanded format. 

9.2.5 Compact format 

The compact format is indicated by tag '8C' in the FCP. In the compact format an access rule consists of an AM byte 
and one or more SC bytes as defined in ISO/IEC 7816-9 [16]. 

The AM byte conveys two types of information. The interpretation of the AM byte itself (coded on b8), and the number 
of SC bytes following, this is equal to the number of bits set to '1' in bits b7 to bl in the AM byte. If b8 in the AM byte 
is set to '0' the interpretation of bits b7 to bl is as defined in ISO/IEC 7816-9 [16]. If b8 in the AM byte is set to '1' the 
usage of bits b7 to b4 is proprietary. 

When multiple sets of an AM byte and one or more corresponding SC bytes are present in the value field they present 
an OR condition. 

EXAMPLE 1: The access rule for READ always for an EF is coded using the compact format as follows. 



Tag 


L 


AM 


SC 


'8C' 


'02' 


'01' 


'00' 



EXAMPLE 2: The access rule for UPDATE user PIN verification and READ always for an EF is coded using the 
compact format as follows. 



Tag 


L 


AM 


SC 


SC 


'8C' 


'03' 


'03' 


'10' 


'00' 
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9.2.6 Expanded format 



The expanded format is indicated by tag 'AB' in the FCP. This tag indicates a constructed data object. In the expanded 
format an access rule consists of one AM_DO followed by a sequence of SC_DOs. The contents of the AM_DO is 
defined by the tag that it is indicated with, see ISO/IEC 7816-9 [16]. Tag '80' indicates that the AM_DO contains an 
AM byte. The sequence of SC_DOs following the AM-DO is relevant for all commands specified in the AM_DO. The 
different SC_DOs can form an OR or an AND condition as defined in ISO/IEC 7816-9 [16]. The information following 
tag 'AB' in the FCP can contain a lot of data if the rule is complex. This information is part of the FCP that is 
transmitted over the interface in the response to a SELECT or a STATUS command. The structure of the security 
attribute in expanded format is as follows. 



Tag 


length 


AM_DO tag 


AM DO 


SC_DO tag 


SC DO 


AM_DO tag 


AM DO 


SC_DO tag 


SC DO 


'AB' 




See ISO/IEC 
7816-9 [16] 




See ISO/IEC 
7816-9 [16] 




See ISO/IEC 
7816-9 [16] 




See ISO/IEC 
7816-9 [16] 





An example using the expanded format coding is given in annex E. 

9.2.7 Access rule referencing 

Access rules may be shared between files in the UICC by referencing. This is accomplished by storing the security 
attributes in the expanded format in a linear fixed file, the Access Rule Reference(EF^jjj^) in the UICC. The structure of 

the EF^sjjj^ file is as follows. 



Record Number (ARR) 


Record Content (Access Rule) 


'01' 


AM_DOl 1 SC.DOj 1 SC.DOgI 1 AM_D0| 1 SC.DOgI 1 SC_D04 .... 


'02' 


AM_DOl 1 SC_DOil 1 AM_DOl 1 SC.DOgl 1 SC.DOg .... 



The referenced format is indicated in the FCP following tag '8B'. The access rule is stored in a file, EF^j^j^. This file is a 
linear fixed file. Referencing is based on the following two methods: 

• File ID and record number (File ID, record number); 

• File ID, SE ID and record number (File ID, SE ID, record number). 

The second possibility allows the usage of different access rules in different security environments. When referencing 
EF^j^jj is based on the file ID, the rules for the location of the access rules are as follows: 

• for an EF, if the EF(ARR) file with the file ID indicated in tag '8B' cannot be found in the current DF, the 
parent DF shall be searched for EF(ARR). This process shall continue until the EF(ARR) is found or until an 
ADF or the MF is reached; 

• for a DF, if the EF(ARR) file with the file ID indicated in tag '8B' cannot be found in the parent DF, the 
grandparent DF shall be searched for EF(ARR). This process shall continue until the EF(ARR) is found or 
until an ADF or the MF is reached; 

• for the MF or an ADF, the EF(ARR) file with the file ID indicated in tag '8B' shall be searched under the MF. 

NOTE: There may be several EF^j^j^ containing access rules under the same DF. They are distinguished and 
referred to by their respective file-IDs. 

The structure of the access rule referencing DO is as follows. 



Tag 


Length 


Value 


'8B' 


'03' 


File ID, record number 


'88' 


'02' + n X '02' 


File ID, SE ID^^, Record number X, SE 10,^,2' Record number Y, etc. 



Each record in EF^j^j^ contains a sequence of AM_DOs followed by SC_DOs. The content of the record is the rule that 
applies for access to the selected file. The content of a sample EF^j^j^ file is given in annex F. The option with the SE 
ID referencing shall be used in an application where several security environments exist. 
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9.3 Security environment 



The security environment is a mechanism to specify for the card system the security functions that are available to 
provide protection to commands for a specific application of the card according to ISO/IEC 7816-8 [15]. The security 
environment for a multi-application UICC is defined as a container for each activated application on the UICC. In case 
of a single application card the security environment is valid for the whole UICC. In the referenced format it is possible 
to indicate different access rules as a function of the SE that is in use. 



9.3.1 Definition of tine security environment 

In case the referenced format contains SEID as the referencing method the terminal shall evaluate the SEID and 
perform the appropriate user verification accordingly. 

The following properties are mapped to SEOl and SEOO. 



SEID 



Properties 



'00' 



(The global Application PIN is disabled AND the Universal PIN is disabled) OR (The global 
Application PIN is disabled AND the Universal PIN is enabled and used) 



'01' 



The global Application PIN is enabled OR (the global Application PIN is disabled AND the 
Universal PIN is enabled but not used) 



The above requirements are derived from table 9.1. A multi-application capability UICC shall support the use of SEOO 
and SEOl in order to allow application verification requirement to be replaced by the Universal PIN. A 
multi-application capability terminal shall support SEID referencing in EF^j^j^. 

Table 9.1 : PIN mapping into SE 



DIM tn 


....«.<:««* 




Universal PIN status 




E 


NE 


APPL_PIN status 


E 


APPL PIN 
SE01 


APPL PIN 
SE01 


NE 


UUP 


Universal PIN 
SEOO 


NO PIN 
SEOO 


DUUP 


NO PIN 
SE01 


NO PIN 
SEOO 


Key: UUP: Use Universal PIN (usage qualifier set to '08'). 

DUUP: Do not Use Universal PIN (usage qualifier set to '00'). 



The Security Environment when no application is active on a given logical channel (SE_No_Active_Application) is set 
as follows: all application PINs assigned on the UICC are considered as APPL_PIN; if at least one of the application 
PINs is disabled, the SE is SE#00 except for the case where the Universal PIN is enabled but the default usage qualifier 
(see clause 9.5.2) is set to "do not use" as defined in table 9.1 (DUUP). This Security Environment is valid under the 
MF and under its child DFs/EFs as long as no application is active. 

The Security Environment when an application is active on a given logical channel (SE_Active_Application) is 
determined as in table 9.1 with the APPL_PIN being the Application PIN of the active application. This Security 
Environment is valid under the ADF/MF and their child DFs/EFs. 

9.3.2 Logical Cinannels and Security Environment 

A UICC supporting logical channels has the security environment set during the application activation and is valid for 
the logical channel on which the application is activated. The security environment remains the same on this logical 
channel until a new application is selected or the status of the PIN status DO has changed, i.e. the application or 
universal PIN status has been changed from disabled to enabled or vice versa. 

The security environment of an application running on a logical channel is inherited when a new channel is opened 
from the non-basic channel. It is evaluated as after the ATR and set as the SE_No_Active_Application when the new 
channel is opened from the basic channel. 
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Any command issued on a logical channel affecting the SE setting only affects the SE on the channel where the 
command was issued and other channels with inherited security from this channel. The SE change on a channel with 
inherited security also changes the SE on the channel from which the security status was inherited. 

9.4 PIN definitions 

The following clauses define the types of PIN that shall exist on a UICC, namely the Universal PIN and the application 
PIN, as well as other types of access conditions needed by the UlCC/an application. 

9.4.1 Universal PIN 

A Universal PIN is a PIN that is used in a multi-application environment to allow several applications to share one 
common PIN. The Universal PIN is a global access condition that has been assigned a key reference value '11'. This key 
reference value shall not be used for anything else but to indicate the Universal PIN. 

In order to give access to several applications on a multi-application UICC, a terminal conforming to the present 
document shall support the usage of the Universal PIN. A multi-application UICC according to the present document 
shall support the usage of a Universal PIN. 

If an application allows the use of the Universal PIN as replacement PIN, the Universal PIN shall be part of the access 
condition for this application on a multi-application UICC that complies to the present document. In case of a single 
verification capable UICC the Universal PIN shall not be used. 

The Universal PIN does not belong to any application, e.g. its verification status cannot be reset by the application 
activation or termination procedures. 

9.4.2 Application PIN 

An application PIN is a PIN that uses a global key reference (defined as level 1 in table 9.2) as defined in table 9.3. The 
application PIN allows access to any file on the UICC where it is referenced in the access rules, i.e. this PIN has global 
access rights with respect to files. It becomes an application PIN based on where it is assigned, and it belongs to the 
corresponding application Security Environment. Its verification status can be reset by the application activation or 
termination procedure. An application, from the security context point of view, may consist of one ore more ADFs/DFs. 
In this case the ADFs/DFs are seen as one application from the security and access rules point of view. All operations 
performed on a PIN (enable/disable/replace) covering several ADFs/DFs affects the applications where the PIN is used 
and the access rules where the corresponding key reference is used. 

9.4.3 Local PIN 

A local PIN is a PIN that uses a local key reference which is only valid within the ADF/DF where it is indicated in the 
FCP. It means that 2 ADFs can use the same local key reference number with two different values and two different 
status (enabled, disabled, verified, blocked), one for each ADF. The verification status of a local PIN is maintained 
when performing file selection. A local PIN shall be indicated in the FCP of child DFs. A local PIN is defined as level 2 
in table 9.2 and coded as defined in table 9.3. A local PIN referenced in an ADF or a DF, which is not DFj^Lg^^Qjyj, 

does not give access to DFjgLg(;;Q]^. 

An ADF shall use only one application PIN and one local PIN. If replacement of the application PIN by the Universal 
PIN is authorized, the ADF shall also use the Universal PIN. Table 9.3 indicates how application PINs and local PINs 
shall be paired (the global key reference '01' is paired with the local key reference '81', the global key reference '02' is 
paired with the local key reference '82', etc.). 

A local PIN can be assigned to a DF which is not part of an ADF. In this case, a key reference indicating a second 
application PIN as defined in table 9.3 shall be used. 

9.4.4 PINs and logical channels 

The PIN status of the Universal PIN and of application PINs is global in the UICC. The PIN status of local PINs exists 
within the ADF/DF where it is specified. 
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The PIN status of the Universal PIN, application PINs, and local PIN is independent from the logical channels. This 
means that when a PIN is verified in one logical channel, it is also verified in all other channels. Also when a PIN is 
enabled in one logical channel it is enabled in all other channels. 

9.5 PIN and key reference relation ship 

This clause describes the relationship between the user verification requirement (PIN) and referencing to a PIN in the 
VERIFY, CHANGE, DISABLE/ENABLE VERIFICATION and UNBLOCK commands. 

9.5.1 Access condition mapping 

Access condition mapping, using SC_DOs, is done using the expanded format with the entries coded as CRT values, 
i.e. tag 'A4' is used. The CRT is a constructed TLV DO containing a usage qualifier TLV DO (tag '95') and a Key 
reference TLV DO (tag '83'). 

The access condition groups are defined according to table 9.2. Each group is divided into several key references. The 
usage of a key reference shall be in accordance with the group definition in table 9.2. 

Table 9.2: Access condition level coding 



Level 


Access Condition 




1 

2 

3 to 4 


ALWays 

User Verification (PIN) 

(see note 1) 

Reserved for Future Use 


5 to 6 

7 


(see note 2) 
NEVer 


NOTE 1 : This level is reserved for a second level of user verification 


(PIN2) that may be defined by an application. 
NOTE 2: Allocation of these levels and the respective requirements for 
their fulfilment are the responsibility of the appropriate 
administrative authority. 



The levels indicated in table 9.2 are used in the present document to refer to a specific group of access conditions. 

A key reference shall only be assigned for the purpose as it is defined in table 9.3, e.g. a level 1 key reference is always 
to be used for an application or a set of applications that share the same access conditions. A level 2 key reference is 
only valid within the ADF/DF where it is indicated. 
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Table 9.3: PIN mapping into key references 



CRT Tag 


Len 


Value 


Access Condition 


Level 


Key Ref 
Tag 


Len 


Value 


Usage 

Qualifier 

Tag 


Len 


Val 


'90' 


'00' 


- 


- 


- 


- 


- 


- 


ALW 





'A4' 
'A4' 
'A4' 
'A4' 


'06' 
'06' 
'06' 
'06' 


'83' 
'83' 
'83' 
'83' 


'01 
'01 
'01 
'01 




'01' 
'02' 
'03' 
'04' 


'95' 
'95' 
'95' 
'95' 


'01 
'01 
'01 
'01 




'08' 
'08' 
'08' 
'08' 


PIN AppI 1 
PIN AppI 2 
PIN AppI 3 
PIN AppI 4 


1 


'A4' 
'A4' 
'A4' 
'A4' 
'XX' 


'06' 
'06' 
'06' 
'06' 
'06' 


'83' 
'83' 
'83' 
'83' 
'83' 


'01 
'01 
'01 
'01 
'01 




'05' 
'06' 
'07' 
'08' 
'09' 


'95' 
'95' 
'95' 
'95' 
'95' 


'01 
'01 
'01 
'01 
'01 




'08' 
'08' 
'08' 
'08' 
'08' 


PIN AppI 5 
PIN AppI 6 
PIN AppI 7 
PIN AppI 8 
RFU 


1 


'A4' 
'A4' 
'A4' 
'A4' 
'A4' 


'06' 
'06' 
'06' 
'06' 
'06' 


'83' 
'83' 
'83' 
'83' 
'83' 


'01 
'01 
'01 
'01 
'01 




'OA' 
'OB' 
'OC 
'OD' 
'OE' 


'95' 
'95' 
'95' 
'95' 
'95' 


'01 
'01 
'01 
'01 
'01 




'08' 
'08' 
'08' 
'08' 
'08' 


ADM1 
ADM2 
ADM3 
ADM4 
ADM5 


5 


'A4' 


'06' 


'83' 


'01 




'11' 


'95' 


'01 




'08' 


PIN Universal PIN 


1 


'XX' 


'06' 


'83' 


'01 




'12-1E' 


'95' 


'01 




'08' 


RFU (Global) 


3 


'A4' 
'A4' 
'A4' 
'A4' 


'06' 
'06' 
'06' 
'06' 


'83' 
'83' 
'83' 
'83' 


'01 
'01 
'01 
'01 




'81' 
'82' 
'83' 
'84' 


'95' 
'95' 
'95' 
'95' 


'01 
'01 
'01 
'01 




'08' 
'08' 
'08' 
'08' 


Second PIN AppI 1 
Second PIN AppI 2 
Second PIN AppI 3 
Second PIN AppI 4 


2 


'A4' 
'A4' 
'A4' 
'A4' 
'A4' 


'06' 
'06' 
'06' 
'06' 
'06' 


'83' 
'83' 
'83' 
'83' 
'83' 


'01 
'01 
'01 
'01 
'01 




'85' 
'86' 
'87' 
'88' 
'89' 


'95' 
'95' 
'95' 
'95' 
'95' 


'01 
'01 
'01 
'01 
'01 




'08' 
'08' 
'08' 
'08' 
'08' 


Second PIN AppI 5 
Second PIN AppI 6 
Second PIN AppI 7 
Second PIN AppI 8 
RFU 


2 


'A4' 
'A4' 
'A4' 
'A4' 
'A4' 


'06' 
'06' 
'06' 
'06' 
'06' 


'83' 
'83' 
'83' 
'83' 
'83' 


'01 
'01 
'01 
'01 
'01 




'8A' 
'8B' 
'8C' 
'8D' 
'8E' 


'95' 
'95' 
'95' 
'95' 
'95' 


'01 
'01 
'01 
'01 
'01 




'08' 
'08' 
'08' 
'08' 
'08' 


ADM6 
ADM7 
ADM8 
ADM9 
ADM10 


6 


'XX' 


'06' 


'83' 


'01 




'90-9E' 


'95' 


'01 




'08' 


RFU (Local) 


4 


'97' 


'00' 


- 


- 


- 


- 


- 


- 


NEV 


7 


NOTE: The CRT value 'XX' for RFU key references is specified at the time when the value is taken 
into use. 



A single verification capable UICC (from the security context point of view) shall use key reference '01' as PIN and key 
reference '81' as PIN2. A multi-verification capable UICC shall use key references in the range of '01' to '08' as PIN and 
may use key references in the range from '81' to '88' as PIN2. In addition a multi-verification capable UICC shall 
support the use of key reference '11' as a universal PIN, see clause 9.3.1 for the definition of a universal PIN. Multiple 
applications (from the security context point of view) on a UICC shall not share any key references except for key 
reference '11', which is used as the universal PIN. 
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9.5.2 PIN status indication 

The status of a PIN that is used by an appHcation for user verification is stored in the PS Template DO and shall be 
indicated in the FCP in a response to the SELECT or STATUS command issued at the application/DF level. The PIN 
status information is indicated in the FCP in the PS template DO using tag 'C6'. The PS template DO conveys two types 
of data, first the PS_DO indicated by tag '90' that indicates the status of the PIN(s) enabled/disabled. The PS_DO is 
followed by one or more key reference data objects indicated by tag '83'. The PIN status may be encoded over several 
bytes. For each bit set to '1' the corresponding key reference (PIN) is enabled. The PS_DO is coded using a bitmap list. 
Bit b8 in the most significant byte corresponds to the first key reference indicated by tag '83' following the PS_DO. 
Bits b7 to bl are mapped to consecutive key references indicated by tag '83'. A key reference data object may be 
preceded by a usage qualifier data object. The usage qualifier data object indicated by tag '95' is mandatory for the 
universal PIN, see clause 9.4.1 and optional for other PINs. This usage qualifier indicates whether an enabled PIN needs 
to be verified for access. If there is no usage qualifier, or if the associated data object is empty, in front of a key 
reference, this indicates that this key reference does not support this feature, and it shall always be verified if enabled. 
The content of the PS_DO usage qualifier is defined in table 9.4. From table 9.4, the value to be used for user PIN 
verification is '08'. The usage qualifier of the Universal PIN is defined in the context of an application and may have 
different value in different applications. 

The default usage qualifier of the Universal PIN after the ATR is set to "do not use" if all application PINs are enabled 
or if at least one of the applications where the application PIN is disabled has the Universal PIN usage qualifier set to 
"do not use". When no application is active on a given logical channel, the Universal PIN usage qualifier is evaluated as 
after the ATR. 

Table 9.4: Usage qualifier coding for PS_DO 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























the verification requirement is not used for 
verification 


1 
















- use verification (DST, CCT) 

- use enciplierment (CT) 

- use external authentication (AT) 




1 














- use computation (DST, CCT) 

- use decipherment (CT) 

- use internal authentication (AT) 


- 


- 


1 


- 


- 


- 


- 


- 


- use SIVI response (CCT, CT, DST) 


- 


- 


- 


1 


- 


- 


- 


- 


- use SM command (CCT, CT, DST) 


- 


- 


- 


- 


1 


- 


- 


- 


use the PIN for verification (Key 
Reference data user knowledge based) 


- 


- 


- 


- 


- 


1 


- 


- 


- use user authentication, biometric based 


- 


- 


- 


- 


- 


- 


X 


X 


RFU (default = 00) 



The PS template DO is constructed as indicated in tables 9.5 and 9.6. 

Table 9.5: PS Template DO structure 



PS 

Template 

DO Tag 


L 


PS-DO 
Tag 


L 


V 
PS-byte(s) 


Key-reference 
tag 


L 


V 


Key-reference 
tag 


L 


V 


'C6' 




'90' 






'83' 


'01' 




'83' 


'01' 





Table 9.6: PS Template DO structure when PS_DO usage qualifier is used 



PS 

Template 

DO Tag 


L 


PS-DO 
Tag 


L 


V 
PS-byte(s) 


Usage 

Qualifier 

tag 


L 


V 


Key-reference 
tag 


L 


V 


Key-reference 
tag 


L 


V 


'C6' 




'90' 






'95' 


'01' 




'83' 


'01' 




'83' 


'01' 
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1 Structure of commands and responses 

This clause defines the command and response APDUs supported by the UICC. 

10.1 Command APDU structure 

This clause states a generic structure of an application protocol data unit - APDU - that is used by the application 
protocol on the top of the transmission protocol for sending a command to the card. 

A command APDU consists of a header and a body part. The contents of the command APDU are depicted in table 10.1 
where the header consists of the CLA, INS, PI and P2 bytes that are mandatory for a command APDU and an optional 
body part that can contain the Lc, Data and Le. Parameters are further explained in clauses 10.1.1 to 10.1.6. 

Table 10.1 : Contents of command APDU 



Code 


Length 


Description 


Grouping 


CLA 


1 


Class of instruction 


Header 


INS 


1 


Instruction code 


PI 


1 


Instruction parameter 1 


P2 


1 


Instruction parameter 2 


Lc 


Oor1 


Number of bytes in the command data field 


Body 


Data 


Lc 


Command data string 


Le 


Oor1 


IVIaximum number of data bytes expected in response of the command 



Four cases of C-APDU structure are possible as defined in table 10.2. 

Table 10.2: Cases of C- APDUs 



Case 


Structure 


1 


CLA INS P1 P2 


2 


CLA INS PI P2 Le 


3 


CLA INS PI P2 Lc Data 


4 


CLA INS P1 P2 Lc Data Le 



10.1.1 Coding of Class Byte 

The most significant nibble of the Class byte (b8 to b5) codes the type of the command as stated in table 10.2. Bits b4 
and b3 are used for indication of secure messaging format (see table 10.4). Bits b2 and bl indicates the logical channel 
used. Logical channels are numbered from to 3. If the card supports the logical channel mechanism, the maximum 
number of available logical channels is indicated in the card capabilities data object of historical bytes of an ATR (refer 
to ISO/IEC 7816-4 [12]). If the card capabilities data object is missing, logical channel b2 = bl = is supported only. 

An application on a UICC supporting logical channels utilizing secure messaging shall either exclude the class byte 
from the signature calculation for the message verification or set it to a default value. The terminal may change the 
logical channel on which the application is executed compared to the logical channel used for the secure messaging 
verification signature. 

Table 10.3: Coding of class byte 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Value 


IVIeaning 














- 


- 


- 


- 


'OX' 


The coding is according to ISO/IEC 7816-4 [12] 


1 





1 





- 


- 


- 


- 


'AX' 


Coded as ISO/IEC 7816-4 [12] unless stated 
otherwise 


1 











- 


- 


- 


- 


'8X' 


Structured as ISO/IEC 7816-4 [12], coding and 
meaning is defined in the present document 


- 


- 


- 


- 


X 


X 


- 


- 


- 


Secure Messaging indication (see table 10.4) 


- 


- 


- 


- 


- 


- 


X 


X 


- 


Logical channel number (see clause 10.3) 
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Table 10.4: Coding of Security Messaging Indication 



b4 


b3 


Meaning 








No SM used between terminal and card 





1 


Proprietary SIVI format 


1 


X 


Secure messaging according to ISO/IEC 7816-4 [12] used 


1 





Command lieader not authenticated 


1 


1 


Command lieader authenticated 



By default no secure messaging is supported by the card, i.e. b4 = b3 = 0, unless it is stated otherwise by an application. 

10.1.2 Coding of Instruction Byte 

Table 10.5 depicts coding of instruction byte of the commands. 

Table 10.5: Coding of Instruction Byte of the Commands 
for a telecom application 



COMMAND 


CLA 


INS 


Command APDUs 






SELECT FILE 


OX 


'A4' 


STATUS 


8X 


'F2' 


READ BINARY 


OX 


'BO' 


UPDATE BINARY 


OX 


'D6' 


READ RECORD 


OX 


'B2' 


UPDATE RECORD 


OX 


'DC 


SEARCH RECORD 


OX 


'A2' 


INCREASE 


ax 


'32' 


VERIFY 


ox 


'20' 


CHANGE PIN 


ox 


'24' 


DISABLE PIN 


ox 


'26' 


ENABLE PIN 


ox 


'28' 


UNBLOCK PIN 


ox 


'2C' 


DEACTIVATE FILE 


ox 


'04' 


ACTIVATE FILE 


ox 


'44' 


AUTHENTICATE 


ox 


'88' 


GET CHALLENGE 


ox 


'84' 


TERMINAL PROFILE 


80 


'10' 


ENVELOPE 


80 


'C2' 


FETCH 


80 


'12' 


TERMINAL RESPONSE 


80 


'14' 


MANAGE CHANNEL 


ox 


'70' 


Transmission oriented APDUs 






GET RESPONSE 


ox 


'CO' 



10.1.3 Coding of parameter bytes 



The value of the parameters PI and P2 depends on the command. If the parameter is not used, the value is set to '00'. 
Coding of the parameter bytes is presented in the command definition clauses. 
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10.1.4 Coding of Lc byte 

The number of data bytes present in the data field of the command APDU is presented in the parameter Lc. Lc is 
optional, in the command APDU, however if the Lc is present in the command APDU, data field consists of Lc 
subsequent bytes. The terminal may send from 1 to 255 bytes of command data. 

10.1.5 Coding of data part 

When present in a command or response APDU the structure of the data field is specific to each command. 

10.1.6 Coding of Le byte 

The maximum number of bytes expected in the data part of the response APDU is presented in the parameter Le, which 
is optional. This means that if the terminal does not expect any data in the response APDU Le is absent from the 
command APDU. However, if Le is present in the command APDU, the data field of the response APDU is expected to 
consist of Le bytes. 

Le set to '00' indicates that the terminal expects to receive at most the maximum number of bytes, i.e. 256, in the 
response ADPU. The UICC may return any number of bytes in the range 1 to 256. 



1 0.2 Response APDU structure 



The response APDU consists of an optional data field and a mandatory status part divided into two bytes; SWl and 
SW2. The number of bytes received in the response APDU is denoted Lr (length of the response data field). The 
structure of the response APDU is shown in table 10.6. 

Table 10.6: Contents of Response APDU 



Code 


Length 


Description 


Data 


Lr 


Response data string 


SW1 


1 


Status byte 1 


SW2 


1 


Status byte 2 



Coding of SWl and SW2 is presented in clause 10.2.1. 

1 0.2.1 Status conditions returned by tine UICC 

Status of the card after processing of the command is coded in the status bytes SWl and SW2. This clause specifies the 
coding of the status bytes. 



10.2.1.1 



Normal processing 

Table 10.7: Status byte coding - normal processing 



SWl 


SW2 


Description 


'90' 


'00' 


- Normal ending of tine command 


'91' 


'XX' 


- Normal ending of the command, with extra information from the 
proactive UICC containing a command for the terminal. Length 'XX' 
of the response data 



10.2.1.2 Postponed processing 



Table 10.8: Status byte coding - postponed processing 



SW1 


SW2 


Error description 


'93' 


'00' 


- SIM Application Toolkit is busy. Command cannot be executed at 
present, further normal commands are allowed 
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10.2.1.3 Warnings 



10.2.1.4 



Table 10.9: Status byte coding - warnings 



SW1 


SW2 


Description 


'62' 


'00' 


No information given, state of non volatile memory unchanged 


'62' 


'81' 


- Part of returned data may be corrupted 


'62' 


'82' 


- End of file/record reached before reading Le bytes 


'62' 


'83' 


- Selected file invalidated 


'63' 


'CX' 


- Command successful but after using an internal update retry routine 
'X' times 

- Verification failed, 'X' retries remaining (see note) 


NOTE: For the VERIFY PIN command, SW1SW2 indicates that the command was 

successful but the PIN was not correct and there are 'X' retries left. For all other 
commands it indicates the number of internal retries performed by the card to 
complete the command. 



Execution errors 



Table 10.10: Status byte coding - execution errors 



SW1 


SW2 


Description 


'64' 


'00' 


No information given, state of non-volatile memory unchanged 


'65' 


'00' 


- No information given, state of non-volatile memory changed 


'65' 


'81' 


Memory problem 



1 0.2.1 .5 Checking errors 



10.2.1.5.1 



Table 10.11 : Status byte coding - checking errors 



SW1 


SW2 


Description 


'67' 


'00' 


- Wrong length 


'67' 


'XX' 


- The interpretation of this status word is command dependent, 
except for SW2 = '00' 


'6B' 


'00' 


- Wrong parameter(s) PI -P2 


'6D' 


'00' 


- Instruction code not supported or invalid 


'6E' 


'00' 


- Class not supported 


'6F' 


'00' 


- Technical problem, no precise diagnosis 


'6F' 


'XX' 


- The interpretation of this status word is command dependent, 
except for SW2 = '00' 



Functions in CLA not supported 

Table 10.12: Status byte coding - functions in CLA not supported 



SW1 


SW2 


Description 


'68' 


'00' 


No information given 


'68' 


'81' 


- Logical channel not supported 


'68' 


'82' 


- Secure messaging not supported 
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10.2.1.5.2 



Command not allowed 



Table 10.13: Status byte coding - command not allowed 



SW1 


SW2 


Description 


'69' 


'00' 


- No information given 


'69' 


'81' 


- Command incompatible witli file structure 


'69' 


'82' 


- Security status not satisfied 


'69' 


'83' 


- Authentication/PIN method blocked 


'69' 


'84' 


- Referenced data invalidated 


'69' 


'85' 


- Conditions of use not satisfied 


'69' 


'86' 


- Command not allowed (no EF selected) 



10.2.1.5.3 



Wrong parameters 



Table 10.14: Status byte coding - wrong parameters 



SW1 


SW2 


Description 


'6A' 


'80' 


- Incorrect parameters in the data field 


'6A' 


'81' 


- Function not supported 


'6A' 


'82' 


File not found 


'6A' 


'83' 


- Record not found 


'6A' 


'86' 


- Incorrect parameters P1 -P2 


'6A' 


'87' 


Lc inconsistent with P1 -P2 


'6A' 


'88' 


- Referenced data not found 



10.2.1.6 Application errors 



Table 10.15: Status byte coding - application errors 



SW1 


SW2 


Error description 


'98' 


'50' 


- INCREASE cannot be performed, max value reached 


'98' 


'62' 


- Authentication error, application specific 


NOTE: Applications may define their own error codes. 
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1 0.2.2 Status words of the commands 

Table 10.16 shows for each command the possible status conditions returned (marked by an asterisk *). 

Table 10.16: Commands and status words 



Status 
Words 


CO 

m 
1— 
m 
o 

H 


(73 

H 
d 


c 

■D 
D 

m 
en 

> 

30 

-< 


d 

-a 
o 

m 

m 
o 
O 

Z) 

a 


Z) 

m 
> 

a 

> 

< 


Zl 

m 
> 

D 
Zl 

m 
o 
O 

Zl 
D 


C/3 

m 
> 

Zl 

o 

I 

ZI 

m 
o 
O 

Zl 

a 


o 

m 
> 

en 
m 


< 

m 

Zl 
Tl 

< 
■a 


o 

z 
> 
z 
G) 
m 

■a 


D 
C/3 
> 
03 

r- 
m 

■D 


m 
> 

03 

1— 

m 

■D 


d 
-z. 

03 

5 

o 

-D 


D 

m 
> 
o 

< 

m 

-n 

i— 
m 


> 

o 

< 

m 

Tl 

i— 
m 


> 

c 

H 
Z 

m 

-z. 

H 

o 

m 


o 
m 

H 
O 
I 
> 

|— 
|— 

m 

o 
m 


H 

m 

Zl 

-z. 
> 

i— 

■a 

Zl 

O 
-n 

i— 
m 


m 
z 
< 

m 

i— 
O 

-D 

m 


Tl 

m 

H 
O 

z 


H 

m 

Zl 

z 
> 

r- 

Zl 
m 

CO 

■a 
O 

z 

CO 

m 


> 

z 
> 

m 

o 

z 
> 
z 
z 
m 
r- 


90 00 

91 XX 
93 00 
98 50 
98 62 
62 00 
62 81 
62 82 

62 83 

63 CX 

64 00 

65 00 
65 81 

67 XX 

68 00 
68 81 

68 82 

69 81 
69 82 
69 83 
69 84 
69 85 
69 86 
6A80 
6A81 
6A82 
6A83 
6A86 
6A87 
6A88 
6B00 
6E00 
6FXX 


* 
* 

* 

* 

* 
* 

* 
* 
* 


* 
* 

* 

* 

* 
* 

* 
* 


* 
* 

* 

* 

* 

* 

* 
* 

* 
* 


* 

* 

* 

* 
* 

* 

* 
* 

* 

* 

* 


* 
* 

* 
* 

* 

* 

* 
* 

* 
* 


* 
* 

* 
* 

* 

* 
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* 

* 

* 
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* 


* 
* 

* 

* 
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* 
* 

* 

* 
* 



The responses '91 XX', and '93 00' can only be given by a UlCC to a terminal supporting CAT (see TS 102 223 [4]). 
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10.3 Logical channels 



Commands referring to a certain logical channel carry the respective logical channel number in the two least significant 
bits of the CLA byte. Logical channels are numbered from to 3. The basic logical channel (number 0) is permanently 
available. 

The MANAGE CHANNEL command shall be used to open and close a logical channel. The channel number is 
assigned by the UICC. 



11 



Commands 



11.1 Generic commands 

This clause lists the basic command and response APDU formats that are used by applications residing on a UICC. It is 
up to each application to determine which commands it uses. If an application does not support a command, it shall 
return the appropriate status word, see clause 10.2. 

11.1.1 SELECT 



11.1.1.1 



Functional description 



This function selects a file according to the methods described in clause 8.4. After a successful selection the record 
pointer is undefined. 



Input: 



Output: 



file ID, application ID, path or empty. 

if the selected file is the MP, a DP or an ADP: 

file ID, total file size, PIN status and other application specific data; 

if the selected file is an EP: 

file ID, file size, total file size, access conditions, invalidated/not invalidated indicator, structure of EP 
and length of the records in case of linear fixed structure or cyclic structure. 



11.1.1.2 



Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 10.1.2 


P1 


Selection control, see table 1 1 .1 


P2 


Selection control, see table 1 1 .2 


Lc 


Length of subsequent data field or empty 


Data 


File ID, DF name, or path to file, according to PI 


Le 


Empty, '00', or maximum length of data expected in response 
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Table 11.1: Coding Of PI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























Select DF, EF or MF by file id 























1 


Select child DF of the current DF 




















1 


1 


Select parent DF of the current DF 

















1 








Selection by DF name (see note) 














1 











Select by path from MF 














1 








1 


Select by path from current DF 


NOTE: This is selection by AID. | 



Table 11.2: Coding of P2 



bS 


b7 


b6 


b5 


b4 


bS 


b2 


b1 


Meaning 


- 


X 


X 


- 


- 


- 


- 


- 


Application session control (see note 2) 

- Activation/Reset 

- Termination 


- 








- 


- 


- 


- 


- 


- 


1 





- 


- 


- 


- 


- 





- 


- 








1 


- 


- 


Return FCP template 





- 


- 





1 


1 


- 


- 


No data returned 


- 


- 


- 


- 


- 


- 


X 


X 


Selection by AID control 


- 


- 


- 


- 


- 


- 








First or only occurrence 


- 


- 


- 


- 


- 


- 





1 


- Last occurrence 


- 


- 


- 


- 


- 


- 


1 





Next occurrence 


- 


- 


- 


- 


- 


- 


1 


1 


- Previous occurrence 


NOTE 1 : Whether the FCI information is returned or not depends on the type of APDU. 
NOTE 2: This only applies when P1 indicates SELECT by DF name. 



If PI = '00' and the data field is empty, then P2 shall be set to 'OC ("No data returned"). Then the MF is set as the 
Current Directory. 

To avoid ambiguities when PI = '00', the following search order applies when selecting a file with a File ID (FID) as a 
parameter: 

• immediate children of the current DF; 

• the parent DF; 

• the immediate children of the parent DF. 

When PI 5^ '04', bits b2 and bl of P2 have no meaning and shall be set to 0. 

When PI = '04' (i.e. for selection by AID), a right truncated AID can be specified in the data field. 

11.1.1.3 Response Data 



Byte(s) 


Description 


Length 


1 


FCP template tag = '62' 


1 


2 (to 3) 


Length of FCP template 


1 or 2 


3 or 4 to L^ 


FCP template 


X 



The response data contains the File Control Parameters (FCP) template of the selected file. The contents of the FCP 
depend on the selected file. See below for the list of TLV that are returned in each case. 

The value part of the FCP template data object consists of data objects, as shown in clause 11.1.1.3.1. It is mandatory 
for data objects to be provided in the order given in the description of each response. New data objects can be added to 
the end of the response data. The terminal shall ignore data objects with tags it does not support. 
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11.1.1.3.1 Response for MF, DF or ADF 

This clause lists the TLVs in the order returned when an MF, DF or ADF is selected. 

Table 11.3: Response for MF, DF, or ADF with FCP template 



Description 


Tag 


Clause 


Status 


File Descriptor 


'82' 


11.1.1.4.3 


M 


File Identifier 


'83' 


11.1.1.4.4 


01 


DF name (AID) 


'84' 


11.1.1.4.5 


02 


Proprietary information 


'A5' 


11.1.1.4.6 


03 


Life Cycle Status Integer 


'8A' 


11.1.1.4.9 


M 


Security attributes 


'86', '8B', '80' 
or 'AB' 


11.1.1.4.7 


04 


PIN Status Template DO 


'06' 


11.1.1.4.10 


M 


Total file size 


'81' 


11.1.1.4.2 





M: Mandatory. 

0: Optional. 

C1 : The File identifier is mandatory for a DF or the MF. For a ADF the File 

identifier is optional. 
C2: DF name is mandatory for only ADF. 
C3: Proprietary information is mandatory for the MF. For a DF/ADF the 

Proprietary information is optional. 
C4: Exactly one shall be present. 



11.1.1.3.2 Response for an EF 

This clause lists the TLVs in the order returned when an EF is selected. 

Table 11.4: Response for an EF with FCP template 



Description 


Tag 


Clause 


Status 


File Descriptor 


'82' 


11.1.1.4.3 


M 


File Identifier 


'83' 


11.1.1.4.4 


M 


Proprietary information 


'A5' 


11.1.1.4.6 





Life Oycle Status Integer 


'8A' 


11.1.1.4.9 


M 


Security attributes 


'86', '8B', 
'80', or 'AB' 


11.1.1.4.7 


01 


File size 


'80' 


11.1.1.4.1 


M 


Total file size 


'81' 


11.1.1.4.2 





Short file identifier (SFI) 


'88' 


11.1.1.4.8 





M: Mandatory. 

0: Optional. 

01 : Exactly one shall be present. 



11.1.1.4 File control parameters 



11.1.1.4.1 



File size 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'80' 


1 


2 


Length 


'02' 


1 


3 to 4 


Number of allocated data bytes in the file, 
excluding structural information 




2 



The range of file size is between '0000' and 'FFFF' and the most significant byte comes first in the value field. 

For transparent EF, file size is the length of the body part of the EF, and for linear fixed or cyclic EF, it is the record 
length multiplied by the number of records of the EF. 
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11.1.1.4.2 



Total file size 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'81' 


1 


2 


Length 


X, X>2 


1 


3 to X+2 


Number of allocated data bytes in the file, including 
structural information if any 




X 


NOTE: If the file is an EF then X=2. 



The most significant byte comes first in the value field. 

For an EF, the range of total file size is between '0000' and 'FFFF'. 

For an EF, the "total file size" represents the allocated memory for the content and the structural information (if any) of 
this EF. 

For a DF, the "total file size" represents the sum of the "total file sizes" of all the EFs and DFs contained in this DF plus 
the amount of available memory in this DF. The size of the structural information of the selected DF itself is not 
included. 



11.1.1.4.3 



File Descriptor 



Byte(s) 


Description 


Status 


Value 


Length 


1 


Tag 


M 


'82' 


1 


2 


Length 


M 


'02' or '05' 


1 


3 


File descriptor byte (see table 1 1 .5) 


M 




1 


4 


Data coding byte 


M 


'21' 


1 


5 to 6 


Record length 


C 


'0001 'to 
'OOFF' 


2 


7 


Number of records 


C 


'01'to'FE' 


1 


IVI: Mandatory. 

C: These bytes are mandatory for linear fixed and cyclic files, otherwise they are not applicable. 



File descriptor. 

Contents: File descriptor specifies the file accessibility, and the file type and structure. 

Coding: See table 11.5. 



£75/ 



Release 5 



72 



ETSI TS 102 221 V5.4.0 (2003-06) 



Table 11.5: File descriptor byte 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 





X 


- 


- 


- 


- 


- 


- 


File accessibility 








- 


- 


- 


- 


- 


- 


Not shareable file 





1 


- 


- 


- 


- 


- 


- 


Shareable file 





- 


X 


X 


X 


- 


- 


- 


File type 





- 











- 


- 


- 


Working EF 





- 








1 


- 


- 


- 


Internal EF 





- 





1 





- 


- 


- 


RFU 





- 





1 


1 


- 


- 


- 





- 


1 








- 


- 


- 





- 


1 





1 


- 


- 


- 





- 


1 


1 





- 


- 


- 





- 


1 


1 


1 


- 


- 


- 


DForADF 





- 


- 


- 


- 


X 


X 


X 


EF structure 





- 


- 


- 


- 











No information given 





- 


- 


- 


- 








1 


Transparent 





- 


- 


- 


- 





1 





Linear fixed 





- 


- 


- 


- 





1 


1 


RFU 





- 


- 


- 


- 


1 











- 


- 


- 


- 


1 





1 





- 


- 


- 


- 


1 


1 





Cyclic 





- 


- 


- 


- 


1 


1 


1 


RFU 


1 


X 


X 


X 


X 


X 


X 


X 


RFU 



Data coding byte. 

Coding: The data coding byte is coded according to table 86 in ISO/lEC 7816-4 [12]. The actual value shall 
not be checked nor used by the terminal. 

Record length. 

Contents: Record length specifies the length of a record when a record structured file has been selected. 

Coding: The record length shall be present if a record structured file (i.e. for linear fixed or cyclic files) is 
selected. In this case it indicates the length the records on 2 bytes. Most significant byte comes 
first in the value field. 

Number of records. 

Contents: Number of records specifies the number of records in a record structured file. 

Coding: The number of records shall be present if a record structured file (i.e. for linear fixed or cyclic 
files) is selected. In this case it indicates the number of records on 1 byte. 



11.1.1.4.4 



File identifier 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'83' 


1 


2 


Length 


'02' 


1 


3 to 4 


File identifier 




2 



11.1.1.4.5 



DF name 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'84' 


1 


2 


Length 


1 <X< 16 


1 


3 to 2+X 


DF name 




X 



DF name is a string of bytes, the AID, which is used to uniquely identify an application dedicated file in the card. 
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11.1.1.4.6 Proprietary information 

This is a constructed TLV object. 



Byte(s) 


Description 


Length! 


1 


Proprietary information constructed Tag = 'A5' 


1 


2 


Length 


1 


3 to 2+X 


Proprietary data, constructed 


X 



The following TLV objects are defined for the proprietary template (tag 'A5'). Additional private TLV objects (bits b7 
and b8 of the first byte of the tag set to '1') may be present after the TLV objects defined in this clause. 

EXAMPLE: A manufacturer, issuer, or application provider specific TLV object may be present. If more than 
one TLV object with the same tag is indicated in this constructed TLV they shall be grouped 
together as the order in which they appear is used to specify the usage. 



Description 


Tag 


Status 


Clause 


U ICC characteristics 


'80' 


C1 


11.1.1.4.6.1 


Application power consumption 


'81' 


C2 


11.1.1.4.6.2 


IVIinimum application clock frequency 


'82' 


C3 


11.1.1.4.6.3 


Amount of available memory 


'83' 


C4 


11.1.1.4.6.4 


C1 : The UICC characteristics are mandatory for the MF. 

C2: Application power consumption, is optional for ADFs. This TLV object shall not be 

present for the IVIF, an EF or DF. 
C3: This TLV object shall not be present for the IVIF, DF or an EF. For an ADF, it is optional. 
C4: This TLV object shall not be present for an EF. For an ADF, DF or the IVIF, it is optional. 



An application may supply more than one application power consumption or minimum application clock frequency 
Data Object. 



11.1.1.4.6.1 



UICC characteristics 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'80' 


1 


2 


Length 


'01' 


1 


3 


UICC characteristics byte (see table 1 1 .6) 




1 



Table 11.6: UICC characteristics byte 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


- 


- 


- 


- 


X 


X 


- 




Clock stop allowed 


- 


- 


- 


- 








- 




No preferred level 


- 


- 


- 


- 





1 


- 




High level preferred 


- 


- 


- 


- 


1 





- 




Low level preferred 


- 


- 


- 


- 


1 


1 


- 




RFU 


- 


- 


- 


- 


X 


X 


- 





Clock stop not allowed 


- 


- 


- 


- 








- 





Never 


- 


- 


- 


- 





1 


- 





Unless at high level 


- 


- 


- 


- 


1 





- 





Unless at low level 


- 


- 


- 


- 


1 


1 


- 





RFU 


- 


- 


- 


X 


- 


- 


- 


- 


Supply voltage class A 


- 


- 


X 


- 


- 


- 


- 


- 


Supply voltage class B 


- 


X 


- 


- 


- 


- 


- 


- 


Supply voltage class C 


X 


- 


- 


- 


- 


- 


X 


- 


RFU (shall be set to 0) 



If bit bl is coded '1', stopping the clock is allowed at high or low level. In this case bit b3 and b4 give information about 
the preferred level (high or low, respectively) at which the clock may be stopped. 

If bl is coded '0', the clock may be stopped only if the mandatory condition b3 = '1' (i.e. stop at high level) or b4 = '1' 
(i.e. stop at low level) is fulfilled. If all 3 bits are coded '0', then the clock shall not be stopped. 
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A supply voltage class, as defined in clause 6.2.1, is supported if the bit is coded as a '1'. If the voltage class is not 
supported the bit is coded as '0'. 



11.1.1.4.6.2 



Application power consumption 



The application power consumption is indicated by tag '81' within the constructed TLV object. The first byte indicates 
the supply voltage at which the power consumption is measured. The coding of this byte is the same as for the supply 
voltage class indication in the ATR, see table 6.1. Unused bits are set to RFU. The second byte indicates the power 
consumption in mA. Bits b8 to b7are RFU. Bits b6 to bl indicates the power consumption of the application in mA. The 
power consumption is measured at the frequency indicated in the 'Power consumption reference frequency' field for the 
application, averaged over 1 ms or at the maximum clock frequency supported by the UICC if no indication is given. 
The terminal shall ignore the application power consumption values '00' and 'FF'. A value higher than 3C shall not be 
interpreted by the terminal and is not to be used. The terminal may still accept the application. 

The terminal shall evaluate the power consumption value given in the response. If the power supply class indicated in 
the response is not the currently used the terminal shall recalculate the value to the currently used supply voltage class. 
The terminal shall accept the application if the recalculated value is within the specification limits set for the currently 
used supply voltage class. The terminal may accept an application that exceeds the specified value if it can support the 
power consumption indicated by the application. 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'81' 


1 


2 


Length 


'03' 


1 


3 


Supply voltage class at which the power 
consumption is measured 




1 


4 


Application power consumption 


'01 '-'3C' 


1 


5 


Power consumption Reference Frequency 


'OA'-'FF' 


1 



The Power consumption Reference Frequency is coded in Hexadecimal format. The resolution is 0,1 MHz, i.e. 'OA' is 
1 MHz and 'FE' is 25,4 MHz. The value 'FF' indicates that no reference frequency is indicated. 



11.1.1.4.6.3 



Minimum application clock frequency 



The application minimum clock frequency is indicated by tag '82' within the constructed TLV object. This TLV object 
indicates to the terminal the minimum clock frequency required by the application. It is up to the application to specify 
a value that is required for commands or procedures to be executed within the required time. An application may 
indicate one or more application minimum clock frequencies if required. In case that more than one TLV object is 
indicated it is up to the application to specify for what purpose the different values are used, i.e. the order of the TLV 
objects within the constructed TLV is relevant. 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'82' 


1 


2 


Length 


'01' 


1 


3 


Application minimum clock frequency 


'OA'-'FF' 


1 



The minimum clock frequency is coded in Hexadecimal format. The resolution is 0,1 MHz, i.e. 'OA' is 1 MHz and 'FE' 
is 25,4 MHz. If this TLV object is not present or the value is 'FF', no minimum application clock frequency is indicated. 

11.1.1 .4.6.4 Amount of available memory 

Amount of memory which is available for DFs or EFs creation under the selected DF (and ADFs under the MF) 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'83' 


1 


2 


Length 


X, X>2 


1 


3 to 2+X 


Number of data bytes 




X 



The most significant byte comes first in the value field. 
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11.1.1.4.7 



Security attributes 



11.1.1.4.7.1 



Compact format 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'8C' 


1 


2 


Length 


X 


1 


3 


AM byte 




1 


X-1 


SC bytes 




X+2 



The value of the AM byte is defined in ISO/IEC 78 1 6-9 [16]. The amount of SC bytes depends upon the value of the 
AM byte. There shall be a SC byte present for each bit set to ' 1 ' in the AM byte except for b8. The value of the SC byte 
is defined in ISO/IEC 7816-9 [16]. 



11.1.1.4.7.2 



Expanded format 



Byte(s) 


Description 


Value 


Length 


Comment 


1 


Tag 


'AB' 


1 




2 


Length 


X-2 


1 




3 


AM DO tag 


'8X' (see note 1 ) 


1 


Security Rule 
#1 


4 


Length 


X 


1 


5+X 


AM DO 


(see note 2) 


X 


6+X 


SC DO tag 


(see note 2) 


1 


7+X 


Length 


Y 


1 


8+X+Y 


SC DO 


(see note 2) 


Y 




















3 


AM DO tag 


'8X' (see note 1 ) 


1 


Security Rule 
#N 


4 


Length 


W 


1 


5+W 


AM DO 


(see note 2) 


W 


6+W 


SC DO tag 


(see note 2) 


1 


7+W 


Length 


Z 


1 


8+W+Z 


SC DO 


(see note 2) 


z 


NOTE 1 : The value of 'X' is dependent on the usage of the AM DO see ISO/IEC 781 6-9 [1 6]. 
NOTE 2: The value of the AM DO and the SC DO is defined in ISO/IEC 781 6-9 [1 6]. 



11.1.1 .4.7.3 Referenced to expanded format 

If the length of the data following tag '8B' = '03' the following definition applies. 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'8B' 


1 


2 


Length 


3 


1 


3-4 


EF^,, File ID 




2 


5 


EFy^PP Record number 




1 



If the length of the data following tag '8B' is '02' + Xx '02' the following definition applies. 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'8B' 


1 


2 


Length 


'02' + X X '02' 


1 


3-4 


EF^,, File ID 




2 


X+4 


SEID 




1 


X+5 


EFy^PPj Record number 






NOTE: For each increment of X a new set of SEID and an EFy^pp Record numbers are 
introduced. 
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11.1.1.4.8 



Short file identifier 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'88' 


1 


2 


Length 


'00' or '01' 


1 


3 


Short file identifier 




Oor1 



If the TLV is not present, the SFI value is the 5 least significant bits (bits b5 to bl) of the file identifier. 

If the TLV is present but empty (i.e. length is 0), the SFI is not supported for the selected file. 

If the length of the TLV is 1, the SFI value is indicated in the 5 most significant bits (bits b8 to b4) of the TLV value 
field. In this case, bits b3 to bl shall be set to 0. 



11.1.1.4.9 



Life cycle status integer 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'8A' 


1 


2 


Length 


1 


1 


3 


Life Cycle Status Integer, see table 1 1 .7 




1 



Table 11.7: Coding of life cycle status integer 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























No information given 























1 


Creation state 




















1 


1 


Initialization state 

















1 


- 


1 


Operational state - activated 

















1 


- 





Operational state - deactivated 














1 


1 


- 


- 


Termination state 


^0 


X 


X 


X 


X 


Proprietary 


Any other value 


RFU 



11.1.1.4.10 



PIN status template DO 



This TLV object contains the PIN status information for a DF/ADF and which PINs are used for access to the DF/ADF 
and its children. PIN is indicated in this data object using the key reference tag '83' as defined in ISO/IEC 7816-4 [12]. 
The content of the constructed PIN status TLV Data Object tag 'C6' depends on the length (see below). 



Byte(s) 


Description 


Value 


Length 


1 


Tag 


'C6' 




2 


Length 






3 


PS DO tag 


'90' 




4 


Length 


X 




X+4 


PS DO 




X 


X+5 


Usage qualifier DO tag (see note 2) 


'95' 




X+6 


Length 


'01' 




X+7 


Usage qualifier, see clause 9.5.2 






X+8 


Key reference tag 


'83' 




X+9 


Length 


'01' 




X+10 


Key reference (PIN) 


see table 9.3 




NOTE 1 : There may be one or more key reference tags following the PS_DO. 
NOTE 2: This TLV DO is mandatory if the Key reference DO value is '1 1' indicating the Universal 
PIN, otherwise it is optional. 
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The usage qualifier DO indicates if the key reference data object (PIN) following it is to be used for verification or not. 
If this data object is present it shall precede the key reference data object it is associated with. 

For the PS_DO coding see clause 9.5.2. For each bit set to '1' in the PS byte, the corresponding key reference in the PS 
Template, DO is enabled. The number of key reference tags (tag '83') indicates how many different PINs are used for 
access in the selected DF and its children. 

11.1.2 STATUS 

11.1.2.1 Functional description 

This function returns information concerning the current directory or current application. 

In addition, according to the application specification, it may be used to indicate to the application in the UICC that its 
session activation procedure has been successfully executed or that its termination procedure will be executed. 

NOTE: These indications may be used to synchronize the applications in the terminal and in the UICC. 

Input: 

• none. 
Output: 

• One of the following: 

FCP of the current directory; 

The DF name TLV Data Object of the currently selected appUcation; 

No data returned. 



11.1.2.2 



Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


Indication of application status (see table 1 1 .8) 


P2 


See table 11.9 


Le 


Empty, '00', or maximum length of data expected in response 



Table 11.8: Coding of PI 



b8 


b7 


b6 


b5 


b4 


b3 


B2 


b1 


Meaning 


























No indication 























1 


Current application is initialized In the 
terminal 




















1 





The terminal will initiate the 
termination of the current application 



Table 11.9: Coding of P2 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























Response parameters and data are 
identical to the response parameters and 
data of the SELECT command 























1 


The DF name TLV-object of the currently 
selected application is returned 














1 


1 








No data returned 


Any other value 


RFU 
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11.1.3 READ BINARY 

11.1.3.1 Functional description 

This function reads a string of bytes from the current transparent EF. This function shall only be performed if the READ 
access condition for this EF is satisfied. 

Input: 

• relative address and the length of the string. 
Output: 

• string of bytes. 

1 1 .1 .3.2 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


PI 


See table 11.10 


P2 


Offset low 


Lc 


Not present 


Data 


Not present 


Le 


Number of bytes to be read 



Table 11.10: Coding of PI 



b8 


B7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 





X 


X 


X 


X 


X 


X 


X 


b7 to b1 is the offset to the first byte to 
read - P2 is the low part of the offset 


1 








X 


X 


X 


X 


X 


SFI referencing used, b1 to b5 are the SFI 
and P2 is the offset to the first byte to read 



Response data: 



Byte(s) 


Description 


Length 


1 -Le 


Data read 


Le 



11.1.4 UPDATE BINARY 



11.1.4.1 



Functional parameters 



This function updates the current transparent EF with a string of bytes. This function shall only be performed if the 
UPDATE access condition for this EF is satisfied. An update can be considered as a replacement of the string already 
present in the EF by the string given in the update command. 

Input: 

• relative address and the length of the string; 

• string of bytes. 
Output: 

• none. 
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11.1 .4.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


See table 11.10 


P2 


Offset low 


Lc 


Length of the subsequent data field 


Data 


String of data to be updated 


Le 


Not present 



Coding of parameter PI and P2 are identical to the coding of PI and P2 in the READ BINARY command. 

11.1.5 READ RECORD 



11.1.5.1 



Functional description 



This function reads one complete record in the current linear fixed or cyclic EF. The record to be read is described by 
the modes below. This function shall only be performed if the READ access condition for this EF is satisfied. The 
record pointer shall not be changed by an unsuccessful READ RECORD function. 

Four modes are defined: 

CURRENT: The current record is read. The record pointer is not affected. 

The record given by the record number is read. The record pointer is not affected. 



ABSOLUTE: 
NEXT: 



PREVIOUS: 



The record pointer is incremented before the READ RECORD function is performed and the 
pointed record is read. If the record pointer has not been previously set within the selected EF, then 
READ RECORD (next) shall read the first record and set the record pointer to this record. 

If the record pointer addresses the last record in a linear fixed EF, READ RECORD (next) shall 
not cause the record pointer to be changed, and no data shall be read. 

If the record pointer addresses the last record in a cyclic EF, READ RECORD (next) shall set the 
record pointer to the first record in this EF and this record shall be read. 

The record pointer is decremented before the READ RECORD function is performed and the 
pointed record is read. If the record pointer has not been previously set within the selected EF, then 
READ RECORD (previous) shall read the last record and set the record pointer to this record. 

If the record pointer addresses the first record in a linear fixed EF, READ RECORD (previous) 
shall not cause the record pointer to be changed, and no data shall be read. 

If the record pointer addresses the first record in a cyclic EF, READ RECORD (previous) shall set 
the record pointer to the last record in this EF and this record shall be read. 



Input: 



• mode, record number (absolute mode only) and the length of the record. 
Output: 

• the record. 
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11.1.5.2 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


Record number 


P2 


Mode, see table 11.11 


Lc 


Not present 


Data 


Not present 


Le 


Number of bytes to be read 



Table 11.11: Coding of P2 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 

















- 


- 


- 


Currently selected EF 


X 


X 


X 


X 


X 


- 


- 


- 


Short File identifier (from 1 to 30) 


- 


- 


- 


- 


- 





1 





Next record 


- 


- 


- 


- 


- 





1 


1 


Previous record 












1 








Absolute/current mode, the record number is 
given in PI with PI ='00' denoting the current 
record 



For the modes "next" and "previous" PI has no significance within the scope of the present document and shall be set to 
'00' by the terminal. 

Response data: 



Byte(s) 


Description 


Length 


1 -Le 


Data read 


Le 



11.1.6 UPDATE RECORD 



11.1.6.1 



Functional description 



This function updates one specific, complete record in the current linear fixed or cyclic EF. This function shall only be 
performed if the UPDATE access condition for this EF is satisfied. The UPDATE can be considered as a replacement 
of the relevant record data of the EF by the record data given in the command. The record pointer shall not be changed 
by an unsuccessful UPDATE RECORD function. 

The record to be updated is described by the modes below. Four modes are defined of which only PREVIOUS is 
allowed for cyclic files: 

CURRENT: The current record is updated. The record pointer is not affected. 

ABSOLUTE: The record given by the record number is updated. The record pointer is not affected. 



NEXT: 



The record pointer is incremented before the UPDATE RECORD function is performed and the 
pointed record is updated. If the record pointer has not been previously set within the selected EF, 
then UPDATE RECORD (next) shall set the record pointer to the first record in this EF and this 
record shall be updated. If the record pointer addresses the last record in a linear fixed EF, 
UPDATE RECORD (next) shall not cause the record pointer to be changed, and no record shall be 
updated. 



£75/ 



Release 5 



81 



ETSI TS 102 221 V5.4.0 (2003-06) 



PREVIOUS: For a linear fixed EF the record pointer is decremented before the UPDATE RECORD fiinction is 
performed and the pointed record is updated. If the record pointer has not been previously set 
within the selected EF, then UPDATE RECORD (previous) shall set the record pointer to the last 
record in this EF and this record shall be updated. If the record pointer addresses the first record in 
a linear fixed EF, UPDATE RECORD (previous) shall not cause the record pointer to be changed, 
and no record shall be updated. 

For a cyclic EF the record containing the oldest data is updated, the record pointer is set to this 
record and this record becomes record number 1 . 

Input: 

• mode, record number (absolute mode only) and the length of the record; 

• the data used for updating the record. 
Output: 

• none. 

11.1 .6.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


Record number 


P2 


Mode, see table 11.11 


Lc 


Length of the subsequent data field 


Data 


String of data to be updated 


Le 


Not present 



Coding of parameter P2 is identical to the coding of P2 in READ RECORD command. 

For the modes "next" and "previous" PI has no significance and shall be set to '00' by the terminal. 

11.1.7 SEARCH RECORD 



11.1.7.1 



Functional description 



This function searches through a linear fixed or cyclic EF to find record(s) containing a specific pattern. This function 
shall only be performed if the READ access condition for this EF is satisfied. The search starts: 

• either at the first byte of the record(s) (simple search); or 

• from a given offset in the record(s); or 

• from the first occurrence of a given byte in the record(s). 

The response is either empty or contains the, up to the Le specified number of, record number(s) of the records that 
matches the search in the selected EF. 

If one or more matches are found the record pointer shall be set to the first record where the search pattern was found. 

Input: 

• search mode (simple/enhanced); 

• offset; 

• pattern. 
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Output: 

• either none, if Le is empty or no matches where found; or 

• at most the number of record(s) number(s) defined in Le. 



11.1.7.2 



Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


Record number ('00' indicates: current record) 


P2 


See table 11.12 


Lc 


Length of the subsequent data field 


Data 


- Simple search: search string 

- Enhanced search: search indication (2 bytes) 
followed by search string 

- Proprietary search: proprietary data 


Le 


Empty or maximum length of response data 



Table 11.12: Coding of P2 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 

















- 


- 


- 


Currently selected EF 


X 


X 


X 


X 


X 


- 


- 


- 


Short File Identifier 


1 


1 


1 


1 


1 


- 


- 


- 


RFU 


- 


- 


- 


- 


- 





X 


X 


RFU (see note) 


- 


- 


- 


- 


- 







X 


Simple search. Usage of PI as a record 
number 


- 


- 


- 


- 


- 










Start forward search from record indicated in 
PI 


- 


- 


- 


- 


- 







1 


Start backward search from record indicated 
in PI 


- 


- 


- 


- 


- 




1 





Enhanced search - see table 11.13 


- 


- 


- 


- 


- 




1 


1 


Proprietary search 


NOTE: This value is reserved by ISO/IEC 781 6-9 [1 6]. 



Table 11.13: Coding of the first byte of the search indication for enhanced search mode 



bS 


b7 


b6 


b5 


b4 


bS 


b2 


b1 


Meaning 























The search starts in the record from the 
offset (absolute position) given in the second 
byte of the search indication 














1 








The search starts in the record after the first 
occurrence of the value contained in the 
second byte of the search indication 


- 


- 


- 


- 


- 





X 


X 


RFU (see note) 


- 


- 


- 


- 


- 




X 


X 


Usage of value of PI as a record number 


- 


- 


- 


- 


- 










Start forward search form record indicated in 
PI 


- 


- 


- 


- 


- 







1 


Start backward search form record indicated 
in PI 


- 


- 


- 


- 


- 




1 





Start forward search from next record 


- 


- 


- 


- 


- 




1 


1 


Start backward search form previous record 


Any other value 


RFU 


NOTE: This value is reserved by ISO/IEC 781 6-9 [1 6]. 



For the modes "forward search from next record" and "backward search from previous record", PI has no significance 
within the scope of the present document and shall be set to '00'. 
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Response data: 



Byte(s) 


Description 


Length 


0-Le 


Record number(s) 


Le 


NOTE: If Le is empty no record numbers will be returned. 



11.1.8 INCREASE 

11.1.8.1 Functional description 

This function adds the value given by the terminal to the value of the last increased/updated record of the current cyclic 
EF, and stores the result into the oldest record. The record pointer is set to this record and this record becomes record 
number 1 . This function can only be used if this EF has an INCREASE access condition assigned and this condition is 
fulfilled. The INCREASE access condition is indicated in the access rules using AM_DO tag '84'. Tag '84' indicates that 
the INS code for the INCREASE command is indicated as the value in the TLV object (instruction code '32'). The 
INCREASE command can only be used on files that refer to an access rule where this INS code is indicated as part of 
the rule. 

The function does not perform the increase if the result would exceed the maximum value of the record (represented by 
all bytes set to 'FF'). 



Input: 



Output: 



value to be added. 



value of the increased record; 



value which has been added. 



11.1 .8.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


See table 11.14 


P2 


'00' 


Lc 


Length of the subsequent data field 


Data 


Value to be added 


Le 


Length of the response data 



Table 11.14: Coding of PI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























Increase the currently selected EF 


1 








X 


X 


X 


X 


X 


SFI referencing used, b1 to b5 are the SFI 


NOTE: All other values are RFU. | 



In this command, Lc is restricted to < Lc < 128 and the maximum record length is limited to 127 bytes. 
Response data: 



Byte(s) 


Description 


Length 


1 -X 


Value of the increased record 


X 


X + 1 - X + Lc 


Value which has been added 


Lc 


NOTE: X denotes the length of the record. 
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11.1.9 VERIFY PIN 

11.1.9.1 Functional description 

11.1.9.1.1 PIN verification 

This function initiates the comparison in the UICC of the PIN verification data sent from the terminal with the PIN 
reference data stored in the card. The security status set as a result of the verification is valid regardless on which 
logical channel the verification is performed. The verification process is subject to the following conditions being 
fulfilled: 

• PIN is not disabled; 

• PIN is not blocked. 

If the access condition for a function to be performed on the last selected file is PIN, then a successful verification of the 
relevant PIN is required prior to the use of the function on this file unless the PIN is disabled. 

If the PIN presented is correct, the number of remaining PIN attempts for that PIN shall be reset to its initial value 3. 

If the PIN presented is false, the number of remaining PIN attempts for that PIN shall be decremented, regardless on 
which logical channel the VERIFY PIN command was issued. The UICC shall return SWl SW2 = '63C2' after the first 
false PIN presentation. The UICC shall return SWl SW2 = '63Cr after the second consecutive false PIN presentation, 
not necessarily in the same card session. After the third consecutive false PIN presentation, not necessarily in the same 
card session, the respective PIN shall be blocked and the UICC shall return SWl SW2 = '63C0'. Any subsequent 
VERIFY PIN command applied to this blocked PIN shall then return SWl SW2 = '6983'. The access condition can 
never be fulfilled until the UNBLOCK PIN function has been successfully performed on the respective PIN. 

Input: 

• indication PIN. 
Output: 

• none. 

11.1.9.1.2 PIN retry counter 

The VERIFY PIN with empty data field is used to retrieve the PIN retry counter from the UICC. This function is 
performed whether or not the relevant PIN is disabled or blocked (e.g. by 3 consecutive wrong PIN presentations). 

The VERIFY PIN command is sent to the UICC with parameter P2 indicating the PIN for which the retry counter value 
is to be retrieved with an empty data field. The number of retries, if any, is indicated in the response by SWl 
S W2 = '63CX', where X indicates the number of retries left. 

A VERIFY PIN command with empty data field appUed to a blocked PIN shall return SWl SW2 = '63C0' or SWl 
SW2 = '6983'. 

Input: 

• empty. 
Output: 

• none. 
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void 



Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


'00' 


P2 


Qualifier of the reference data, 


see table 11.15 


Lc 


Empty or '08' 


Data 


EMPTY or PIN value 


Le 


Not present 



Table 11.15: Coding of P2 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























Not supported 





- 


- 


- 


- 


- 


- 


- 


Global reference data (e.g. IVIF specific PIN) 


1 


- 


- 


- 


- 


- 


- 


- 


Specific reference data (e.g. DF 
specific/application dependent PIN) 


- 


X 


X 


- 


- 


- 


- 


- 


'00' (other values are RFU) 


- 


- 


- 


X 


X 


X 


X 


X 


Reference data number ('01 ' to '1 F') 



The five least significant bits of parameter P2 specify the PIN key reference number (see clause 9.5.1). 
Command data: 



Byte(s) 


Description 


Length 


1 -8 


PIN value 


8 



11.1.10 CHANGE PIN 



11.1.10.1 



Functional description 



The Change PIN command is used to initiate the comparison of the verification data with the PIN, and then to 
conditionally replace the existing PIN with the new PIN sent to the UICC in the command. Once successfully changed 
on a logical channel, the new value is immediately available to all channels. 

This function assigns a new value to the relevant PIN subject to the following conditions being fulfilled: 

• PIN is not disabled; 

• PIN is not blocked. 

The old and new PIN shall be presented. 

If the old PIN presented is correct, the number of remaining PIN attempts for that PIN shall be reset to its initial value 3 
and the new value for the PIN becomes valid. 

If the old PIN presented is false, the number of remaining PIN attempts for that PIN shall be decremented and the value 
of the PIN is unchanged. After 3 consecutive false PIN presentations, not necessarily in the same card session, the 
respective PIN shall be blocked and the access condition can never be fulfilled until the UNBLOCK PIN function has 
been performed successfully on the respective PIN. 



Input: 



indication of PIN, old PIN, new PIN. 
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Output: 



none. 



11.1.10.2 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 10.1.2 


P1 


'00' 


P2 


As specified for the VERIFY PIN command, see clause 1 1 .1 .9 


Lc 


Length of the subsequent data field = '1 0' 


Data 


Old PIN value, new PIN value 


Le 


Not present 



NOTE: "Change PIN" is named "exchange reference data" in ISO/IEC 7816-8 [15]. 



Byte(s) 


Description 


Length 


1 -8 


Old PIN value 


8 


9-16 


New PIN value 


8 



11.1.11 DISABLE PIN 
11.1.11.1 Functional description 

The Disable PIN command is used to switch off the requirement to compare the PIN verification data with the PIN 
reference data. The command also allows an indication whether to use an alternative global key reference, if enabled, or 
not when the application PIN is disabled. For universal PIN definition see clause 9.4.1. Usage of an alternative global 
key reference for user verification is indicated in parameter PI. If an alternative global key reference is used as a 
replacement for the application PIN, the usage qualifier in the PS_DO template data object for the alternative global key 
reference is set to "use" = '08'. The verification of the alternative global key reference shall be performed instead of the 
application PIN verification to get access to the application. 

The UICC shall perform a validation of the SE after the successful execution of this command as the current SE may 
have changed and this shall affect the access to files. 

NOTE 1 : The access rules for the application must cater for the case that an alternative global key reference 
replaces the application PIN. It is the responsibility of the application to specify this. 

The successful execution of this function has the effect that files protected by PIN are now accessible as if they were 
marked "ALWAYS", except in the case where the alternative global key reference is to be used as a replacement for the 
disabled PIN. In this case the access condition for files containing only a reference to the disabled PIN is the alternative 
global key reference. For files having more than one global key reference indicated in the access rules the access 
condition is "ALWAYS" after disabling on of the key references used in the access rules. The function DISABLE PIN 
shall not be executed by the selected application when PIN is already disabled or blocked. 

NOTE 2: Every application must specify whether this function is applicable to all PINs defined for the application. 

If the PIN presented is correct, the number of remaining PIN attempts shall be reset to its initial value 3 and PIN shall 
be disabled. 

If the PIN presented is false, the number of remaining PIN attempts shall be decremented and PIN remains enabled. 
After 3 consecutive false PIN presentations, not necessarily in the same card session, the PIN shall be blocked and the 
access condition can never be fulfilled until the UNBLOCK PIN function has been successfully performed on PIN. 



Input: 



PIN. 
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Output: 



none. 



11.1.11.2 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


See table 11.16 


P2 


As specified for the VERIFY PIN command, 


see clause 11.1.9 


Lc 


Length of the subsequent data = '08' 


Data 


PIN value 


Le 


Not present 



Table 11.16: Coding of PI 



bS 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























Verification data present in data field 























1 


Reserved by ISO/IEC 7816-8 [15] 


1 


- 


- 


- 


- 


- 


- 


- 


Verification data present, and use reference 
data number as verification replacement 


- 


X 


X 


- 


- 


- 


- 


- 


'00' (other values are RFU) 


- 


- 


- 


X 


X 


X 


X 


X 


Global key reference data number ('01 ' to '1 F') 



Command data: 



Byte(s) 


Description 


Length 


1 -8 


PIN value 


8 



11.1.12 ENABLE PIN 
11.1.12.1 Functional description 

The Enable PIN command is used to switch on the requirement to compare the PIN verification data with the PIN 
reference data. It is the reverse function of DISABLE PIN. If an alternative global key reference has been used as a 
replacement for the application PIN. The usage of the alternative global key reference as a replacement shall be disabled 
upon enabling the PIN for which the alternative global key reference has been a replacement (setting the usage qualifier 
in the PS_DO template data object for the alternative global key reference to do not use = '00'). 

The UICC shall perform a validation of the SE after the successful execution of this command as the current SE may 
have changed and this shall affect the access to files. 

The function ENABLE PIN shall not be executed by the selected application when PIN is already enabled or blocked. 

Every application shall specify whether this function is applicable to all PINs defined for the application. 

If the PIN presented is correct, the number of remaining PIN attempts shall be reset to its initial value 3 and PIN shall 
be enabled. 

If the PIN presented is false, the number of remaining PIN attempts shall be decremented and PIN remains disabled. 
After 3 consecutive false PIN presentations, not necessarily in the same card session, PIN shall be blocked and may 
optionally be set to "enabled". Once blocked, the PIN can only be unblocked using the UNBLOCK PIN function. If the 
PIN is blocked and "disabled", the access condition shall remain granted. If the PIN is blocked and "enabled", the 
access condition can never be fulfilled until the UNBLOCK PIN function has been successfully performed on PIN. 



Input: 



PIN. 
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Output: 



none. 



11.1.12.2 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


'00' 


P2 


As specified for the VERIFY PIN command, 


see clause 11.1.9 


Lc 


Length of the subsequent data = '08' 


Data 


PIN value 


Le 


Not present 



Command data: 



Byte(s) 


Description 


Length 


1 -8 


PIN value 


8 



11.1.13 UNBLOCK PIN 



11.1.13.1 Functional description 



11.1.13.1.1 



PIN unblocking 



This function is used to reset the PIN retry counter to its initial value and then to conditionally set a new PIN value. 
This function may be performed whether or not the relevant PIN is blocked (e.g. by 3 consecutive wrong PIN 
presentations). This unblocking process is subject to the following condition being fulfilled: 

• UNBLOCK PIN is not blocked. 

If the UNBLOCK PIN presented is correct, the value of the PIN, presented together with the UNBLOCK PIN, is 
assigned to that PIN, the number of remaining UNBLOCK PIN attempts for that UNBLOCK PIN is reset to its initial 
value 10 and the number of remaining PIN attempts for that PIN is reset to its initial value 3. After a successful 
unblocking attempt the PIN is enabled and the relevant access condition level is satisfied the new PIN value is available 
for all channels. 

If the presented UNBLOCK PIN is false, the number of remaining UNBLOCK PIN attempts for that UNBLOCK PIN, 
regardless on which logical channel the UNBLOCK PIN command was issued, shall be decremented. The UICC shall 
return SWl SW2 = '63C9', '63C8', ... '63C1' for up to the ninth consecutive false UNBLOCK PIN presentation, not 
necessarily in the same card session. After the tenth consecutive false UNBLOCK PIN presentation, not necessarily in 
the same card session, the respective UNBLOCK PIN shall be blocked and the UICC shall return SWl SW2 = '63C0'. 
Any subsequent UNBLOCK PIN command applied to this blocked UNBLOCK PIN shall then return SWl 
SW2 = '6983'. A false UNBLOCK PIN shall have no effect on the status of the respective PIN itself. 



Input: 



Output: 



indication PIN, the UNBLOCK PIN and the new PIN. 



none. 



11.1.13.1.2 



UNBLOCK PIN retry counter 



The UNBLOCK PIN command with empty data field is used to retrieve the UNBLOCK PIN retry counter from the 
UICC. This function may be performed whether or not the relevant PIN is blocked (e.g. by 3 consecutive wrong PIN 
presentations) and whether or not the UNBLOCK PIN is blocked. 
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The UNBLOCK PIN command is sent to the UICC with parameter P2 indicating the PIN for which the UNBLOCK 
PIN retry counter value is to be retrieved with an empty data field. The number of retries, if any, is indicated in the 
response by SWl SW2 ='63CX', where X indicates the number of retries left. 

An UNBLOCK PIN command with empty data field applied to a blocked UNBLOCK PIN shall return SWl 
SW2 = '63C0' or SWl SW2 = '6983'. 



Input: 



empty. 



Output: 



none. 



11.1.13.2 void 



11.1.13.3 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 10.1.2 


P1 


'00' 


P2 


As specified for the VERIFY PIN command (see clause 1 1 


1.9) 


Lc 


Empty or '10' 


Data 


Empty or UNBLOCK PIN value, new PIN value 


Le 


Not present 



Command data: 



Byte(s) 


Description 


Length 


1 -8 


UNBLOCK PIN value 


8 


9-16 


New PIN value 


8 



11.1.14 DEACTIVATE FILE 
11.1.14.1 Functional description 

This function initiates a reversible deactivation of an EF. After a DEACTIVATE FILE function the respective flag in 
the file LCSI_DO shall be changed accordingly. This function shall only be performed if the DEACTIVATE FILE 
access condition for the EF is satisfied. 

In case of successful execution of the command, the EF on which the command was applied becomes the current EF. 

After an unsuccessful execution, the current EF and current DF shall remain the same as prior to the execution. 

A deactivated file shall no longer be available within the selected application for any function except for the SELECT 
and the ACTIVATE FILE functions. 



Input: 



file ID, path or empty. 



Output: 



none. 
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11.1.14.2 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


selection control, see table 11.17 


P2 


00 


Lc 


Length of subsequent data field or empty 


Data 


File ID or path to file, according to PI 


Le 


Not present 



Table 11.17: Coding of PI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























Select EF by file id 














1 











Select by path from MF 














1 








1 


Select by path from current DF 


NOTE: All other values are RFU. 



If PI = P2 = '00' and the data field is empty, then the command apphes on the current EF. 

11.1.15 ACTIVATE FILE 

11.1.15.1 Functional description 

This function reactivates a deactivated EF. After an ACTIVATE FILE function the respective flag in the file LCSI_DO 
shall be changed accordingly. This function shall only be performed if the ACTIVATE FILE access condition for the 
EF is satisfied. 

In case of successful execution of the command, the EF on which the command was applied becomes the current EF. 

After an unsuccessful execution, the current EF and current DF shall remain the same as prior the execution. 

Input: 

• file ID, path or empty. 
Output: 

• none. 

11.1.15.2 Command parameters 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


PI 


As specified for the DEACTIVATE command (see clause 11.1.1 4.2) 


P2 


00 


Lc 


Length of subsequent data field or empty 


Data 


File ID or path to file, according to PI 


Le 


Not present 



If PI = P2 = '00' and the data field is empty, then the command apphes on the current EF. 
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11.1.16 AUTHENTICATE 

11.1.16.1 Functional description 

An appropriate application shall be selected in the UICC before issuing this command. The function initiates the 
computation of authentication data by the UICC using a challenge sent from the terminal and a secret stored in the 
UICC. 

Input: 

• challenge data. 
Output: 

• authentication and ciphering data. 

11.1.16.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


'00' 


P2 


See table 11.18 


Lc 


Length of the subsequent data field 


Data 


Authentication related data 


Le 


Length of the response data 



NOTE 1: Parameter PI = '00' indicates that no information on the algorithm is given. The algorithm is implicitly 
known in the context of the selected application. 

Table 11.18: Coding Of P2 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


B1 


Meaning 


























No information given 





- 


- 


- 


- 


- 


- 


- 


Global reference data (e.g. MP specific KEY) 


1 


- 


- 


- 


- 


- 


- 


- 


Specific reference data (e.g. DP 
specific/application dependent KEY) 


- 


X 


X 


- 


- 


- 


- 


- 


'00' (other values are RPU) 


- 


- 


- 


X 


X 


X 


X 


X 


Reference data number ('01 ' to '1 P') 



NOTE 2: Parameter P2 = '00' indicates that no information on the key is given. The key is implicitly known in the 
context of the selected application. 

Command data: 





Byte(s) 


Description 


Length 




1 -Lc 


Authentication related data (see note) 


Lc 




NOTE: The command data must be specified by each application specific document. 


da 


ta (generic): 




Byte(s) 


Description 


Length 




1 -Le 


Authentication related data (see note) 


Le 




NOTE: The response data must be specified by each application specific document. 
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11.1.17 MANAGE CHANNEL 

11.1.17.1 Functional description 

This command opens and closes logical channels. The open function opens a new logical channel other than the basic 
channel '0'. The UICC shall support channel number assignment by the UICC. The close function explicitly closes a 
logical channel. When a channel has been successfully closed, the channel can be reassigned. The basic logical channel 
'0' is always available and cannot be closed. 

Input: 



Output: 



none. 



none, or 



the channel number of the logical channel assigned by the UICC. 



1 1 .1 .1 7.2 Command parameters and data 



Code 



CLA 



INS 



P1 



P2 



Lc 



Data 



Le 



Value 



As specified in clause 10.1.1 



As specified in clause 1 0.1 .2 



Logical channel operation code, see table 11.19 



See table 11.20 



Not present 



Not present 



Not present or length of expected data 



Table 11.19: Coding of PI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


Meaning 


























Open logical channel 


1 























Close logical channel 


NOTE: All other values are RFU. 



Table 11.20: Coding of P2 



b8 


b7 


b6 


b5 


b4 


bS 


b2 


b1 


Meaning 


























if PI ='00': Logical channel to be internally assigned by the UICC 
if P1?s'00': reserved 























1 


Logical channel number 1 




















1 





Logical channel number 2 




















1 


1 


Logical channel number 3 


NOTE 1 : All other values are RFU. 

NOTE 2: values '01 ', '02', '03' are valid only with PI ='80'. 



Response data: 



Byte(s) 


Description 


Length 


1 


Logical channel number 


1 



Response data shall only be returned if the value of the parameters P1-P2 of the command is '0000'. 
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11.1.18 GET CHALLENGE 

11.1.18.1 Functional description 

This function is used to create a random number. The generated random number is associated with the logical channel 
specified in the GET CHALLENGE command CLA. The maximum length of the random number returned by the 
UICC is specified by the Le parameter in the command parameters data. 

The quality of the random number generated by this command is determined by the application and is outside the scope 
of the present document. 

The generated random number may be used internally by the UICC in procedures specified by the application. The 
validity of the random number is at least for the next command, on the same logical channel, following the GET 
CHALLENGE command if not specified differently by the application. The random number referenced is always the 
latest generated on the logical channel specified in the CLA by the command referencing the usage of a generated 
random number. 

Input: 



none. 



Output: 



random number. 



1 1 .1 .1 8.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


'00' 


P2 


'00' 


Lc 


Not present 


Data 


Not present 


Le 


IVIaximum length of response data 



Response data: 



Byte(s) 


Description 


Length 


1 -Lr 


Random number 


Lr 



1 1 .2 CAT commands 
11.2.1 TERMINAL PROFILE 

11.2.1.1 Functional description 

This function is used by the terminal to transmit its CAT capabilities to the applications present on the UICC. 
Input: 

• terminal profile, the structure of the data is defined in TS 102 223 [4]. 
Output: 

• none. 
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1 1 .2.1 .2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


'00' 


P2 


'00' 


Lc 


Length of the subsequent data field 


Data 


Structure and coding defined in TS 102 223 [4] 


Le 


Not present 



11.2.2 ENVELOPE 

1 1 .2.2.1 Functional description 

This function is used to transfer CAT information from the UE to the UICC. 
Input: 

• the structure of the data is defined in TS 102 223 [4]. 
Output: 

• the structure of the data is defined in TS 102 223 [4]. 

1 1 .2.2.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


PI 


'00' 


P2 


'00' 


Lc 


Length of the subsequent data field 


Data 


Structure and coding defined in TS 102 223 [4] 


Le 


Empty or maximum length of response data 



Response data: 

• structure of the response data is defined in TS 102 223 [4] for CAT applications. 

11.2.3 FETCH 

1 1 .2.3.1 Functional description 

This function is used to transfer a proactive command from the UICC to the terminal (e.g. from a CAT application). 
Input: 



none. 



Output: 



data string containing a proactive command for the terminal (e.g. a CAT command). 
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1 1 .2.3.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


'00' 


P2 


'00' 


Lc 


Not present 


Data 


Not present 


Le 


Length of expected data 



Response data: 

• structure of the response data is defined in TS 102 223 [4] for CAT applications. 

1 1 .2.4 TERMINAL RESPONSE 



11.2.4.1 



Functional description 



This function is used to transfer from the terminal to the UICC the response to a previously fetched proactive command 
(e.g. a CAT command). 



Input: 



data string containing the response. 



Output: 



none. 



1 1 .2.4.2 Command parameters and data 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


PI 


'00' 


P2 


'00' 


Lc 


Length of the subsequent data field 


Data 


Structure and coding defined in TS 102 223 [4] 


Le 


Not present 



12 Transmission oriented commands 

This clause lists all transport specific commands. Currently there is only one such command. 

12.1 T=0 specific commands 

12.1.1 GET RESPONSE 

12.1.1.1 Functional description 

The command is used to transmit APDUs from the card to the terminal, which otherwise could not be transferred by the 
protocol. 
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The response data depends on the preceding command. Response data is available when it is indicated in the procedure 
byte, see table 7.1, or status byte, see table 7.2. If the command GET RESPONSE is executed, it is required that it is 
executed immediately after the command it is related to (no other command shall come between the command/response 
pair and the command GET RESPONSE). If the sequence is not respected, the selected application shall send the status 
information "technical problem, no precise diagnosis" as a reaction to the GET RESPONSE. 

The response data itself is defined in the clause for the corresponding command. 

Because there is no interleaving of commands between logical channels, the terminal shall send the GET RESPONSE 
command on the same logical channel before sending a command APDU in another logical channel. Otherwise, the 
response is lost. 



12.1.1.2 



Command parameters 



Table 12.1 : Parameters for GET RESPONSE 



Code 


Value 


CLA 


As specified in clause 10.1.1 


INS 


As specified in clause 1 0.1 .2 


P1 


'00' 


P2 


'00' 


Lc 


Not present 


Data 


Not present 


Le 


'00' or value of SW2 of the previous command 



Response parameters and data: 

• the response data is defined in each clause of the corresponding command. 

NOTE: Since the MP is implicitly selected after UICC activation, GET RESPONSE is also allowed as the first 
command after activation for only GSM ME. 3G ME should send SELECT MF or STATUS command 
with FCP response. 



1 3 Application independent files 

13.1 EFdir 

EFqjj^ is a linear fixed file under the MF and is under the responsibility of the issuer. 

Table 13.1 : EFpip at MF-level 



Identifier: '2F00' 


1 


Structure: Linear fixed 1 Mandatory 


SFI: Mandatory 




Record size: 


X bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




ALW 
ADM 
ADM 
ADM 


Bytes 


Description 


M/0 


Length 


1 -X 


Application template TLV object 


M 


X bytes 



The EF consists of one or more records, with each record able to hold one entry. Each entry in the EF^jj^ is an 
application template Data Object (DO) as defined in ISO/IEC 7816-5 [13]. An application template DO is a constructed 
BER-TLV object with a maximum length of 127 bytes and has a mandatory AID DO. Within the scope of the present 
document, all other DOs are optional. 
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In table 13.2 the coding of the mandatory DOs and the optional DOs that has special meaning to the present document. 
All other DOs are according to ISO/IEC 7816-5 [13]. 

Table 13.2: Coding of an application template entry 



Length 


Description 


Status 




Application template tag = '61' 


M 




Length of the application template = '03'-'7F' 


M 




Application Identifier tag = '4F' 


M 




AID length = '01 '-'10' 


M 


'01' -'10' 


AID value. For 3G applications, see TS 101 220 [3] 


M 




Application label tag = '50' 







Application label length 





note 1 


Application label value 





NOTE 1 : The application label is a DO that contains a string of bytes 

provided by the application provider to be shown to the user for 
information, e.g. operator name. The value part of the application 
label shall be coded according to annex A. In ISO/IEC 7816-5 [13] 
the application label is limited to 16 bytes, this does not apply to 
the present document it is however recommended that the number 
of bytes does not exceed 32. 

NOTE 2: Other DOs from ISO/IEC 781 6-5 [1 3] may, at the application 
issuer's discretion, be present as well. 



1 3.2 EFicciD (ICC Identification) 

This EF provides a unique identification number for the UICC. 

Table 13.3: EF|ccid 3* IWF-level 



Identifier: '2FE2' 


1 


Structure 


transparent | Mandatory 


SFI: Optional 




File size: 10 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




ALW 
NEV 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 - 10 


Identification nu 


mber 






M 


10 bytes 



• Identification number: 

Contents: according to ITU-T Recommendation E. 1 18 [5]. 
Purpose: card identification number. 

Coding: BCD, left justified and padded with 'F'. The order of digits is coded as below: 
Byte 1: 



b8 B7 b6 b5 b4 b3 b2 bl 



LSB of Digit 1 



MSB of Digit 1 
LSB of Digit 2 



MSB of Digit 2 
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LSB of Digit 3 



MSB of Digit 3 
LSB of Digit 4 



MSB of Digit 4 



etc. 



13.3 EFpL (Preferred Languages) 



This EF contains the codes for up to n languages. This information, determined by the user/operator, defines the 
preferred languages of the user, for the UICC, in order of priority. 

Table 13.4: EFpL at MF-level 



Identifier: '2F 05' Structure: transparent | 


Mandatory 


SFI: IVIandatory 


1 


File size: 2n bytes 


Update activity 


low 


Access Conditions: 

READ ALW 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -2 


1^' language code (highest prior) 


M 


2 bytes 


3-4 


2"'^ language code 





2 bytes 










2n-1 -2n 


nth language code (lowest prior) 





2 bytes 



Coding: each language code is a pair of alpha-numeric characters, defined in ISO 639 [6]. Each alpha- 
numeric character shall be coded on one byte using the SMS default 7-bit coded alphabet as 
defined in TS 123 038 [1] with bit 8 set to 0. 

Unused language entries shall be set to 'FF FF'. 

13.4 EFarr (Access Rule Reference) 

This EF contains the access rules for files located under the MF in the UICC. If the security attribute tag '8B' is 
indicated in the FCP it contains a reference to a record in this file. 
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Table 13.5: EF^rr at MF-level 



Identifier: '2F06' 


Structure: 


Linear fixed 1 Optional 


SFI: Optional 




Record length: X bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ALW 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 -X 


Access Rule TLV data objects 


M 


X bytes 



This EF contains one or more records containing access rule information according to the referenced format as defined 
in ISO/IEC 7816-9 [16]. Each record represents an access rule. Unused bytes in the record are set to 'FF'. 



14 Application independent protocol 

14.1 File related procedures 

14.1.1 Reading an EF 

Reading of an EF can be done in two different ways. 

1) If the short file identifiers are used the following procedure applies: 

if short file identifiers are used, EFs that support SFI within the Current Directory can be read without 
explicitly selecting the EF. The terminal selects the DF or ADF and sends a READ command. This 
contains the short file identifier of the EF to be read and the location of the data to be read. If the access 
condition for READ is fulfilled, the application sends the requested data contained in the EF to the 
terminal. If the access condition is not fulfilled, no data will be sent and an error code will be returned. 

2) If the short file identifiers are not used the following procedure applies: 

the terminal selects the EF and sends a READ command. This contains the location of the data to be 
read. If the access condition for READ is fulfilled, the application sends the requested data contained in 
the EF to the terminal. If the access condition is not fulfilled, no data will be sent and an error code will 
be returned. 

14.1.2 Updating an EF 

Updating of an EF can be done in two different ways: 

1) If the short file identifiers are used the following procedure applies: 

if short file identifiers are used, EFs that support SFI within the Current Directory can be updated 
without explicitly selecting the EF. The terminal selects the DF or ADF and sends an UPDATE 
command. This contains the short file identifier of the EF and the location of the data to be updated and 
the new data to be stored. If the access condition for UPDATE is fulfilled, the application updates the 
selected EF by replacing the existing data in the EF with that contained in the command. If the access 
condition is not fulfilled, the data existing in the EF will be unchanged, the new data will not be stored, 
and an error code will be returned. 
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2) If the short file identifiers are not used the following procedure applies: 

the terminal selects the EF and sends an UPDATE command. This contains the location of the data to be 
updated and the new data to be stored. If the access condition for UPDATE is fulfilled, the application 
updates the selected EF by replacing the existing data in the EF with that contained in the command. If 
the access condition is not fulfilled, the data existing in the EF will be unchanged, the new data will not 
be stored, and an error code will be returned. 

14.1.3 Increasing an EF 

Increasing of an EF can be done in two different ways: 

1) If the short file identifiers are used the following procedure applies: 

if short file identifiers are used, EFs that support SFI within the Current Directory can be increased 
without explicitly selecting the EF. The terminal selects the DF or ADF and sends an INCREASE 
command. This contains the short file identifier of the EF and the value which has to be added to the 
contents of the last updated/increased record. If the access condition for INCREASE is fulfilled, the 
application increases the existing value of the EF by the data contained in the command, and stores the 
result. If the access condition is not fulfilled, the data existing in the EF will be unchanged and an error 
code will be returned. 

2) If the short file identifiers are not used the following procedure applies: 

the terminal selects the EF and sends an INCREASE command. This contains the value which has to be 
added to the contents of the last updated/increased record. If the access condition for INCREASE is 
fulfilled, the application increases the existing value of the EF by the data contained in the command, and 
stores the result. If the access condition is not fulfilled, the data existing in the EF will be unchanged and 
an error code will be returned. 

NOTE: The identification of the data within an EF to be acted upon by the above procedures is specified within 
the command. For the procedures in clauses 14.1.1 and 14.1.2 this data may have been previously 
identified using a SEARCH RECORD command, e.g. searching for an alphanumeric pattern. 



14.2 PIN related procedures 



NOTE: The present document specifies only the generic behaviour of a PIN. An application may create a set of 
PINs each with a specific behaviour. 

A successful completion of one of the following procedures grants the access right of the corresponding PIN for an 
application session. This right is valid for all files within the application protected by this PIN. 

After a third consecutive unsuccessful completion of one of the following procedures associated to the same PIN, not 
necessarily in the same application session, the PIN becomes "blocked" and if the PIN status is set "enabled", the access 
right previously granted by this PIN is lost immediately. 

An access right is not granted if any of the following procedures are aborted. 

14.2.1 PIN verification 

The terminal checks the PIN and the following procedures apply: 

If the PIN status is set "enabled" and the PIN is "blocked", the procedure ends and is finished unsuccessfully. 



• 



• 



If the PIN status is set "disabled" and the PIN is "blocked", the procedure ends and is finished successfully. 
The terminal shall, however, accept applications which do not grant access rights when the PIN status is set 
"disabled" and the PIN is "blocked". In that case terminal shall consider those applications as "blocked". 

If the PIN status is set "disabled" and the PIN is not "blocked", the procedure is finished successfully. 
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• If the PIN status is set "enabled" and the PIN is not "blocked", the terminal uses the VERIFY PIN function. If 
the PIN presented by the terminal is equal to the corresponding PIN stored in the application, the procedure is 
finished successfully. If the PIN presented by the terminal is not equal to the PIN which protects the 
application, the procedure ends and is finished unsuccessfully. 

1 4.2.2 PIN value substitution 

The terminal checks the PIN and the following procedures apply: 

• If the PIN status is set "disabled" or the PIN is "blocked", the procedure ends and is finished unsuccessfully. 

• If the PIN status is set "enabled" and the PIN is not "blocked", the terminal uses the CHANGE PIN function. If 
the old PIN presented by the terminal is equal to the PIN which protects the application, the new PIN 
presented by the terminal is stored instead of the old one and the procedure is finished successfully. 

• If the old PIN presented by the terminal and the PIN which protects the application are not identical, the 
procedure ends and is finished unsuccessfully. 

14.2.3 PIN disabling 

PIN enabling and disabling/disabling and replacement may be disallowed by an application. If it is allowed then the 
following procedures shall be followed: 

• If either the PIN status is set "disabled" or the PIN is "blocked", the procedure ends and is finished 
unsuccessfully. 

Disabling and replacement 

• If the application PIN is not "blocked" and both the application PIN and the alternative global key reference 
statuses are set to "enabled", the terminal uses the DISABLE PIN function. If the PIN presented by the 
terminal is equal to the PIN which protects the application, the status of the PIN is set "disabled" and the usage 
qualifier of the alternative global key reference is set to "use" ('08') and the procedure is finished successfully. 
If the PIN presented by the terminal is not equal to the PIN which protects the application, the procedure ends 
and is finished unsuccessfully. 

Disabling, no replacement 

• If the PIN is not "blocked" and the PIN status is set "enabled", the terminal uses the DISABLE PIN function. 
If the PIN presented by the terminal is equal to the PIN which protects the application, the status of the PIN is 
set "disabled" and the procedure is finished successfully. If the PIN presented by the terminal is not equal to 
the PIN which protects the application, the procedure ends and is finished unsuccessfully. 



14.2.4 PIN enabling 



PIN enabling and disabling may be disallowed by an application. If it is allowed then the following procedures shall be 
followed: 

• If either the PIN status is set "enabled" or the PIN is "blocked", the procedure ends and is finished 
unsuccessfully. 

• If the PIN status is set "disabled" and the PIN is not "blocked", the terminal uses the ENABLE PIN function. If 
the PIN presented by the terminal is equal to the PIN which is assigned to the application, the status of the PIN 
is set "enabled" and the procedure is finished successfully. If the PIN presented by the terminal is not equal to 
the PIN which protects the application, the procedure ends and is finished unsuccessfully. 

14.2.5 PIN unblocking 

The execution of the PIN unblocking procedure is independent of whether or not the PIN is "blocked". 

The terminal checks if the UNBLOCK PIN is "blocked". If the UNBLOCK PIN is "blocked", the procedure ends and is 
finished unsuccessfully. 
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If the UNBLOCK PIN is not "blocked", the terminal uses the UNBLOCK PIN function. If the UNBLOCK PIN 
presented by the terminal is equal to the corresponding UNBLOCK PIN of the application, the relevant PIN becomes 
"unblocked" and the procedure is finished successfully. If the UNBLOCK PIN presented by the terminal is not equal to 
the corresponding UNBLOCK PIN of the application, the procedure ends and is finished unsuccessfully. 

14.3 Application selection procedures 

14.3.1 Application selection by use of the EFdir file 

Application selection by use of the EF^jj^ file is the procedure where the terminal reads the content of the EFpjj^ file 
and presents the list of applications to the user whom can then make select one or more applications to activate. 

The terminal performs the read procedure with EF^jj^ and presents the applications that it supports to the user who may 
make a selection. If only one supported application is found this may be implicitly selected. 

1 4.3.2 Direct application selection 

An application may be selected, without reading the content of the EFqjj^ file, by performing the SELECT procedure 
with the AID of the application to be selected. 

1 4.3.3 Direct application selection with partial AID 

See clause 8.5. L2. 

14.4 General application related procedures 

14.4.1 Application session activation 

The terminal performs the SELECT function with the AID of the selected application as a parameter. 

If the SELECT function ends successfully the selected application's initialization procedure is executed. If the 
initialization procedure ends successfully the UICC enters the operation state. If the initialization procedure does not 
end successfully, the UICC remains in the application management state and sends an indication to the user that it was 
not possible to activate the selected application. 

14.4.2 UICC application interrogation 

The list of applications residing in the UICC can be read at anytime when the UICC is not inactive. 
Request: The terminal performs the read procedure with EFpjj^. 

1 4.4.3 UICC application session termination 

An application session can be terminated at any time when the UICC is not inactive. 

14.5 Miscellaneous procedures 
14.5.1 UICC activation 

After activation of the UICC, as defined in clause 4.5, the terminal requests the Preferred Language (EFpL). If the 
terminal supports CAT, it shall perform the CAT initialization procedure. The terminal then performs an application 
selection procedure according to clause 14.3. 
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14.5.2 UICC presence detection 

If an application present on the UICC has the requirement to ensure that the UICC has not been removed during a card 
session the following procedure applies. The terminal sends, at frequent intervals, a STATUS command on the 
UlCC-terminal interface. The STATUS command shall be issued within a period of inactivity on the UlCC-terminal 
interface. The period of inactivity and the conditions under which the presence detection takes place is specified by the 
applications active during the card session. Inactivity in this case is defined as starting at the end of the last 
communication or the last issued STATUS command. If no response data is received to this STATUS command the 
terminal shall take the appropriate actions after the work waiting time (T=0) or block waiting time (T=l) has expired as 
specified by the applications active. If the DF indicated in an error free response to a STATUS command is not the 
same as that which was indicated in the previous response, or accessed by the previous command, then the terminal 
shall take appropriate actions as specified by the applications active during the card session. This procedure shall be 
used in addition to a mechanical or other device used to detect the removal of a UICC. 

14.5.3 UICC preferred language request 

Request: The terminal performs the read procedure with EFp^. 

Update: The terminal performs the update procedure with EFpL- 



14.5.4 UICC logical channels 



A UICC may offer the possibility to run several selectable applications in parallel. This is done with the logical 
channels mechanism. Only one selectable application can run at a given time in a given logical channel. 



14.6 CAT related procedures 



The higher level procedures, and contents and coding of the commands, are given in TS 102 223 [4]. Procedures 
relating to the transmission of commands and responses across the terminal-UICC interface are given in this clause. A 
UICC or terminal supporting CAT shall conform to the requirements given in this clause. 

14.6.1 CAT Initialization procedure 

A terminal supporting CAT shall send the TERMINAL PROFILE C-APDU. A UICC supporting CAT shall return the 
response status words (SWl SW2) '90 00' or '91 XX'. If any other value is returned, the terminal shall assume that CAT 
is not supported. In case of proactive command pending, the terminal shall then start the proactive polling procedure 
with the default value. 

14.6.2 Proactive polling 

During idle mode the terminal shall send STATUS commands to the UICC at intervals no longer than the interval 
negotiated with the UICC (see TS 102 223 [4]). During a call the UICC presence detection applies. The default value 
for the proactive polling is the same as for the presence detection procedure. 

1 4.6.3 Support of commands 

A terminal supporting CAT shall support the commands TERMINAL PROFILE, ENVELOPE, FETCH and 
TERMINAL RESPONSE. 

1 4.6.4 Support of response codes 

A terminal supporting CAT shall support the response status words (SWl SW2) '91 XX' and '93 00'. 
These responses shall never be used if the terminal does not support CAT. 
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1 4.6.5 Independence of applications and CAT tasks 

Application and CAT operation shall be logically independent, both in the UICC and in the terminal. Specifically, this 
means: 



• 



• 



The currently selected EF and current record pointer in any active application shall remain unchanged, if still 
valid, as seen by the terminal, irrespective of any CAT activity. 

Between successive CAT related command-response pairs, other application (e.g. USIM) and UICC related 
command-response pairs can occur. The CAT task status shall remain unchanged by these command-response 
pairs. 

1 4.6.6 Use of BUSY status response 

If for any reason the CAT task of the UICC cannot process an ENVELOPE command issued by the terminal at present 
(e.g. other CAT processes are already running), the UICC can respond with a status response of '93 00'. The terminal 
may re-issue the command at a later stage. 

The BUSY status response has no impact on e.g. USIM operation. 

14.6.7 Additional processing time 

The Transport Protocol provides a mechanism for the UICC to obtain additional processing time (i.e. NULL procedure 
byte for T=0 and Work Waiting time extension (WTX) for T=l) before supplying the response part of a 
command-response pair, during which time the terminal is unable to send further commands to the UICC. 

If a CAT activity in the UICC runs for too long, this may prevent the terminal from sending e.g. USIM commands 
which are time-critical, e.g. INTERNAL AUTHENTICATE. A MORE TIME command is defined in TS 102 223 [4], 
which ensures that the CAT task in the UICC gets additional processing time, while at the same time freeing the 
UlCC/terminal interface. The MORE TIME command should be used in preference to the transport protocol specific 
mechanisms for obtaining additional processing time. 
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Annex A (normative): 

UCS2 coding of Alpha fields for files residing on the UICC 

If 16 bit UCS2 characters as defined in ISO/IEC 10646-1 [17] are used in an alpha field, the coding can take one of 
three forms. If the terminal supports UCS2 coding of alpha fields in the UICC, the terminal shall support all three 
coding schemes for character sets containing 128 characters or less; for character sets containing more than 
128 characters, the terminal shall at least support the first coding scheme. If the alpha field record contains GSM default 
alphabet characters only, then none of these schemes shall be used in that record. Within a record, only one coding 
scheme, either the GSM default alphabet (see TS 123 038 [1]), or one of the three described below, shall be used. 

1) If the first byte in the alpha string is '80', then the remaining bytes are 16 bit UCS2 characters, with the more 
significant byte (MSB) of the UCS2 character coded in the lower numbered byte of the alpha field, and the less 
significant byte (LSB) of the UCS2 character is coded in the higher numbered alpha field byte, i.e. byte 2 of 
the alpha field contains the more significant byte (MSB) of the first UCS2 character, and byte 3 of the alpha 
field contains the less significant byte (LSB) of the first UCS2 character (as shown below). Unused bytes shall 
be set to 'FF', and if the alpha field is an even number of bytes in length, then the last (unusable) byte shall be 
set to 'FF'. 

EXAMPLE 1: 



Bytel 


Byte 2 


Bytes 


Byte 4 


Bytes 


Byte 6 


Byte? 


Bytes 


Byte 9 


'80' 


Ch1|viSB 


Ch1|_gg 


Ch2MSB 


Ch2LSB 


ChSivisB 


Ch3L3B 


'FF' 


'FF' 



2) 



If the first byte of the alpha string is set to '81', then the second byte contains a value indicating the number of 
characters in the string, and the third byte contains an 8 bit number which defines bits 15 to 8 of a 16 bit base 
pointer, where bit 16 is set to zero, and bits 7 to 1 are also set to zero. These sixteen bits constitute a base 
pointer to a "half-page" in the UCS2 code space, to be used with some or all of the remaining bytes in the 
string. The fourth and subsequent bytes in the string contain codings as follows; if bit 8 of the byte is set to 
zero, the remaining 7 bits of the byte contain a GSM Default Alphabet character, whereas if bit 8 of the byte is 
set to one, then the remaining seven bits are an offset value added to the 16 bit base pointer defined earlier, and 
the resultant 16 bit value is a UCS2 code point, and completely defines a UCS2 character. 



EXAMPLE 2: 



Bytel 


Byte 2 


Bytes 


Byte 4 


Bytes 


Byte 6 


Byte? 


Bytes 


Byte 9 


'81' 


'05' 


'13' 


'53' 


'95' 


'A6' 


'XX' 


'FF' 


'FF' 



In the above example: 

byte 2 indicates that there are 5 characters in the string; 

byte 3 indicates bits 15 to 8 of the base pointer, and indicates a bit pattern of Ohhh hhhh hOOO 0000 as the 

16 bit base pointer number. Bengali characters for example start at code position 0980 

(0000 1001 1000 0000), which is indicated by the coding '13' in byte 3 (shown by the bold digits); 

byte 4 indicates GSM Default Alphabet character '53', i.e. "S"; 

byte 5 indicates a UCS2 character offset to the base pointer of '15', expressed in binary as follows 001 
0101, which, when added to the base pointer value results in a sixteen bit value of 0000 1001 1001 0101, 
i.e. '0995', which is the Bengali letter KA; 

byte 8 contains the value 'FF', but as the string length is 5, this a valid character in the string, where the 
bit pattern 111 1111 is added to the base pointer, yielding a sixteen bit value of 0000 1001 1111 1111 for 
the UCS2 character (i.e. '09FF'). 
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3) If the first byte of the alpha string is set to '82', then the second byte contains a value indicating the number of 
characters in the string, and the third and fourth bytes contain a 16 bit number which defines the complete 
16 bit base pointer to a "half-page" in the UCS2 code space, for use with some or all of the remaining bytes in 
the string. The fifth and subsequent bytes in the string contain codings as follows; if bit 8 of the byte is set to 
zero, the remaining 7 bits of the byte contain a GSM Default Alphabet character, whereas if bit 8 of the byte is 
set to one, the remaining seven bits are an offset value added to the base pointer defined in bytes three and 
four, and the resultant 16 bit value is a UCS2 code point, and defines a UCS2 character. 

EXAMPLE 3: 



Bytel 


Byte 2 


Bytes 


Byte 4 


Bytes 


Byte 6 


Byte? 


Bytes 


Byte 9 


'82' 


'05' 


'05' 


'30' 


'2D' 


'82' 


'D3' 


'2D' 


'31' 



In the above example: 

byte 2 indicates that there are 5 characters in the string; 

bytes 3 and 4 contain a sixteen bit base pointer number of '0530', pointing to the first character of the 
Armenian character set; 

byte 5 contains a GSM Default Alphabet character of '2D', which is a dash "-"; 

byte 6 contains a value '82', which indicates it is an offset of '02' added to the base pointer, resulting in a 
UCS2 character code of '0532', which represents Armenian character Capital Ben; 

byte 7 contains a value 'D3', an offset of '53', which when added to the base pointer results in a UCS2 
code point of '0583', representing Armenian Character small Piwr. 
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Annex B (informative): 
Main states of a UICC 



A UICC complying with the present document has the following states of operation: 

• "Inactive" - In this state the UICC is powered off. 

• "Application management" - In this state it is possible to start/end one or more application-session(s) as well as 
retrieve the list of applications in the UICC. This state can be entered at any time when the UICC is not in the 
inactive state and left when the PIN access condition for all the selected applications has been verified. 

• "Operation" - This state is entered after the application session activation procedure for at least one application 
has ended successfully. 



Activate 




De- activate 



Appl_sel_req 



Figure B.1 : UICC states 
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Annex C (informative): 

APDU protocol transmission examples 

C.1 Exchanges Using T=0 

The following examples illustrate exchanges of data and procedure bytes between the terminal and the UICC. 
Note the following: 

• The use of procedure bytes '60' and I N S is not illustrated. 

• [Data(X)] means X bytes of data. 

• Case 2 and 4 commands may have Le = '00' requesting the return of all data from the UICC up to the 
maximum available. 

The examples in clauses C. 1.1.1 to C. 1.1. 4 illustrate typical exchanges using case 1 to 4 commands. The examples in 
the clauses C.1.1.5 and C.1.1.6 illustrate the more extensive use of procedure bytes '61 XX' when used with case 2 and 
4 commands. The example in clause C.1.1.7 illustrates a warning condition with a case 4 command. 



C.1.1 Case 1 command 

A C-APDU of {CLA INS PI P2} is passed from the terminal to the UICC (note that P3 of the C-TPDU is set to '00'). 



C-TPDU 



Terminal 



[CLA INS P1 P2 P3=00] 



UICC 



90 00 



An R-APDU of {90 00} is returned from the UICC to the terminal. 



C.1.2 Case 2 command 

In this first example, a C-APDU of {CLA INS PI P2 Le = 00} is passed from the terminal to the UICC with 
Luicc < 256 bytes. 



C-TPDU 
C-TPDU 



Terminal 



[CLA INS PI P2 P3=00] 



[CLA INS P1 P2 Luicc] 



UICC 



6C Luicc 



INS [Data(Luicc)] 90 00 



An R-APDU of { [Data(Luicc)] 90 00} is returned from the UICC to the terminal. 

In this second example, a C-APDU of {CLA INS PI P2 Le = 00} is passed from the terminal to the UICC with 
Luicc = 256 bytes. 



C-TPDU 



Terminal 



[CLA INS PI P2 P3=00] 



UICC 



INS [Data(Luicc)] 90 00 



An R-APDU of { [Data(Luicc)] 90 00} is returned from the UICC to the terminal. 
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C.1.3 Case 3 command 

A C-APDU of {CLA INS PI P2 Lc [Data(Lc)] } is passed from the terminal to the UICC. 



C-TPDU 



Terminal 



[CLA INS P1 P2 P3=Lc] 



[Data(Lc)] 



UICC 



[INS] 



90 00 



An R-APDU of {90 00} is returned from the UICC to the terminal. 



C.1.4 Case 4 command 

A C-APDU of {CLA INS PI P2 Lc [Data (Lc)] Le = 00} is passed from the terminal to the UICC. 



C-TPDU 



GET RESPONSE 



Terminal 



[CLA INS P1 P2 P3=Lc] 



[Data(Lc)] 



[00 CO 00 00 Luicc] 





UICC 










«■ 


[INS] 






«■ 


61 Luicc 






«■ 


CO [Data(Luicc)] 90 00 



An R-APDU of { [Data(Luicc)] 90 00} is returned from the UICC to the terminal. 

C.1 .5 Case 2 commands Using the '61 ' and '6C' procedure bytes 

A C-APDU of {CLA INS PI P2 Le = 00} is passed from the terminal to the UICC with Luicc < 256 bytes. 



C-TPDU 



GET RESPONSE 



Terminal 



[CLA INS P1 P2 P3=00] 



[CLA INS P1 P2 Luicc] 



[00 CO 00 00 YY] 



[00 CO 00 00 ZZ] 





UICC 










«■ 


6C Luicc 






«■ 


61 XX 






«■ 


CO [Data(YY)] 61 ZZ 






«■ 


CO [Data(ZZ)] 90 00 



Where YY < XX, 

An R-APDU of { [Data(YY + ZZ)] 90 00} is returned from the UICC to the terminal. 
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C.1 .6 Case 4 command Using the '61 ' procedure byte 

A C-APDU of {CLA INS PI P2 Lc [Data Lc] Le = 00} is passed from the terminal to the UICC. 



C-TPDU 



GET RESPONSE 



Terminal 



[CLA INS P1 P2 P3=Lc] 



[Data(Lc)] 



[00 CO 00 00 XX] 



[00 CO 00 00 YY] 



UICC 






[INS] 




61 XX 




CO [Data{XX)] 61 YY 




CO [Data(YY)] 90 00 



An R-APDU of {[Data(XX + YY)] 90 00} is returned from the UICC to the terminal. 

C.1 .7 Case 4 command with warning condition 

A C-APDU of (CLA INS PI P2 Lc [Data Lc] Le = 00} is passed from the terminal to the UICC. 



C-TPDU 



GET RESPONSE 



Terminal 



[CLA INS PI P2 P3=Lc] 



[Data(Lc)] 



[00 CO 00 00 00] 



[00 CO 00 00 Luicc] 



UICC 






[INS] 




62 XX 




6C Luicc 




CO [Data(Luicc)] 90 00 



An R-APDU of { [Data(Luicc)] 62 XX} is returned from the terminal to the UICC containing the data returned together 
with the warning status bytes. 
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Annex D (informative): 
ATR examples 

This annex gives examples of ATRs that can be returned by a UICC after a reset. 
EXAMPLE 1 : Cold reset for a T=0 protocol only UICC. 



Character 


Value 


Description 


TS 


'3B' or '3F' 


Indicates direct or inverse convention 


TO 


'97' 


TA1 and TD1 are present 
7 bytes of liistorica! bytes 


TA1 


'95' 


Clocl< rate conversion factor Fl=9 (F=512) 
Baud rate adjustment factor Dl=5 (D=16) 


TD1 


'80' 


TD2 only is present 


TD2 


'1F' 


TA3 only is present 

Global interface bytes following 


TA3 


'42' 


Clock stop supported (low electrical state) 
3V UICC 


T1 


'80' 




T2 


'31' 


Card data services 


T3 


'AO' 


SELECT by AID supported 
EFDIR present 


T4 


'73' 


Card capabilities 


T5 


'BE' 


SFI supported 


T6 


'21' 


Data Coding Byte 


T7 


'00' 


No extended Lc and Le 

No Logical channels supported 


TCK 


'XX' 


Check byte 



EXAMPLE 2: Cold reset for a T=0 and T= 1 protocol UICC. 



Character 


Value 


Description 


TS 


'3B' or '3F' 


Indicates direct or inverse convention 


TO 


'97' 


TA1 , and TD1 are present 
7 bytes of historical bytes 


TA1 


'95' 


Clock rate conversion factor Fl=9 (F=512) 
Baud rate adjustment factor Dl=5 (D=16) 


TD1 


'80' 


Only TD2 is present 

Protocol T=0 supported by UICC 


TD2 


'B1' 


TA3, TBS and TD3 are present 
Protocol T=1 supported by UICC 


TA3 


'FE' 


IFSC is 254 bytes long 


TB3 


'00' 


Block Waiting lnteger=0 
Character Waiting lnteger=0 


TD3 


'IF' 


Only TA4 is present 

Global interface bytes following 


TA4 


'42' 


Clock stop supported (low electrical state) 
3V UICC 


T1 


'80' 




T2 


'31' 


Card data services 


T3 


'AO' 


SELECT by AID supported 
EFDIR present 


T4 


'73' 


Card capabilities 


T5 


'BE' 


SFI supported 


T6 


'21' 


Data Coding Byte 


T7 


'00' 


No extended Lc and Le 

No Logical channels supported 


TCK 


'XX' 


Check byte 
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EXAMPLE 3: Warm reset (specific mode) and T=l protocol requested by the UICC. 



Character 


Value 


Description 


TS 


'3B' or '3F' 


Indicates direct or inverse convention 


TO 


'97' 


TA1 , and TD1 are present 
7 bytes of historical bytes 


TA1 


'95' 


Clock rate conversion factor Fl=9 {F=512) 
Baud rate adjustment factor Dl=5 (0=16) 


TD1 


'91' 


TA2 and TD2 are present 
Protocol T=1 supported by UICC 


TA2 


'81' 


Protocol T=1 used in specific mode 

Parameters indicated by the interface bytes, and card is 

not able to change mode 


TD2 


'81' 


TA3, TB3 and TD3 are present 
Protocol T=1 supported by UICC 


TA3 


'FE' 


IFSC is 254 bytes long 


TBS 


'00' 


Block Waiting lnteger=0 
Character Waiting lnteger=0 


TD3 


'IF' 


Only TA4 is present 

Global interface bytes following 


TA4 


'42' 


Clock stop supported (low electrical state) 


T1 


'80' 




T2 


'31' 


Card data services 


T3 


'AO' 


SELECT by AID supported 
EFpip present 


T4 


'73' 


Card capabilities 


T5 


'BE' 


SFI supported 


T6 


'21' 


Data Coding Byte 


T7 


'00' 


No extended Lc and Le 

No Logical channels supported 


TCK 


'XX' 


Check byte 
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Annex E (informative): 

Security attributes mechanisms and examples 

E.1 Coding 

Two codings are defined: 

• a compact coding based on bitmaps; 

• an expanded coding which is an extension of the compact coding with intermediate scope containing bitmap 
and TLV Ust management. 

The security conditions for bits not set to T in the AM byte are set to NEVer by default. 

E.2 Compact format 

The compact format access rule is indicated by tag '8C' in the FCP. An access rule in this format is encoded with: 

• an AM byte as defined in ISO/IEC 7816-9 [16]; 

• one or more SC bytes as defined in ISO/IEC 7816-9 [16]. 

E.2.1 AlVlbyte 

The AM byte conveys two types of information: 

• interpretation of the AM byte itself; 

• number of SC bytes in the access rule. 

If b8 in the AM byte is set to '0' the AM byte is followed by a number of SC bytes equal to the number of bits set to '1' 
in the AM byte (excluding b8). Each SC bytes codes the conditions relevant to a set of commands, in the same order (b7 
to bl) as in the AM byte. When b8 is set to T the usage of b7 to b4 is proprietary. 

When multiple sets of an AM byte and one or more corresponding SC bytes are present in the value field of the DO, tag 
'8C' they represent an OR condition. 



E.2.2 SC byte 



The SC byte specifies which security mechanisms are necessary to conform to the access rules, see 
ISO/IEC 7816-9 [16]. The 4 most significant bits (b8 to b5) indicate the required security condition. An SE may be 
specified in bits b4 to bl. If an SE is specified, the mechanisms that may be defined in it for external authentication, 
user authentication and command protection shall be used, if indicated by bits b4 to bl. 

If bit b8 is set to '1' all conditions in bits b7 to b5 shall be satisfied. If bit b8 is set to '0' at least one of the conditions set 
in bits b7 to b5 shall be satisfied. If b7 is set to '1', the CRT of the SE indicated in bits b4 to bl describes whether secure 
messaging shall apply to the command APDU, the response APDU or both. 

E.2. 3 Examples 

For EFs with the access condition ALW for READ and UPDATE the security attribute would look as follows: 



Tag 


L 


AM 


SC 


SC 


'8C' 


'03' 


'03' 


'GO' 


'GO' 
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For EFs with the access condition ALW for READ and NEV for all other access conditions the security attribute would 
look as follows: 



Tag 


L 


AM 


sc 


'8C' 


'02' 


'01' 


'00' 



For EFpjjj and EF j^^^ the access rule would be as follows. READ is set to always UPDATE, DEACTIVATE and 
ACTIVATE is set to ADM. The ADM condition is indicated as a user authentication. The key reference is implicitly 
known. 



Tag 


L 


AM 


SC 


SC 


SC 


SC 


'8C' 


'05' 


'1B' 


'90' 


'90 


'90' 


'00' 



E.3 Expanded format 



In the expanded format AM_DOs and SC_DOs are used to create the access rules. The expanded format access rule is 
indicated by tag 'AB' in the FCI. An access rule in this format is encoded with an AM_DO followed by a sequence of 
SC_DOs. 

E.3.1 AM_DO 

The AM_DO is defined in ISO/IEC 7816-9 [16]. The content of the AM_DO is defined by the tag value. Tag '80' 
indicates that the AM_DO contains an AM byte. Tags '8r-'8F' indicates that the AM_DO contains a command 
description. The content of the command description is dependent upon the tag value as defined in 
ISO/IEC 7816-9 [16]. Tag '9C' indicates that the AM_DO contains a proprietary state machine description. 

When multiple sets of an AM_DO and one or more corresponding SC_DOs are present in the value field of the DO, tag 
'AB', they represent an OR condition. 

E.3.2 SC_DO 

The SC_DO is defined in ISO/IEC 7816-9 [16]. The SC_DO definition contains an OR and an AND template. Several 
SC_DOs may be attached to a particular operation. 

• if the SC_DOs are encapsulated in an OR template, then only one of the security conditions has to be fulfilled 
for the operation to be allowed; 

• if the SC_DOs are not to be encapsulated in an OR template or if the SC_DOs are encapsulated in an AND 
template, then all security conditions shall be fulfilled before the operation is allowed. 



E.3. 3 Access rule referencing 



Access rules in expanded format (AM_DOs and SC_DOs) may be stored in a linear fixed EF, each record contain one 
or more rules, as defined in ISO/IEC 7816-9 [16]. The access rule file may be an internal file, referenced implicitly, or 
may be referenced explicitly, e.g. by a file ID. The access rule stored in a file is indicated by tag '8B' in the FCI. The 
value of this DO contains at least one record number, called ARR. The DO can contain: 

• a single byte containing the record number of the rule, valid if the access rule file is (implicitly) known; 

• three bytes containing two bytes with the File ID of the access rule file followed by one byte with the record 
number for the access rule; 

• if the value filed is coded with a length of 2 H- n x 2, for n > 1, it contains one or more SEID/ARR pairs, where 
the SEID codes the SE number on one byte. For each SE number, the access rules indicated in the ARR 
following its SE number are valid. 
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E.3.4 Examples 



The access rule for EFp^ would look as follows. The READ and SEARCH access condition is ALWays. The UPDATE 
access condition is application! PIN or application2 PIN. 
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'AB' 


■1A' 


■80' 


'01' 


'02' 


'AC 


'10' 


'A4' 


'06' 


'83' 


'01' 


'01 


'95' 


'01' 


'08' 


'A4' 


'06' 


'83' 


'01' 


'02' 


'95' 


'01' 


'08' 


'80' 


'01' 


'01' 


'90' 


'00' 
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Annex F (informative): 

Example of contents of EFarr '2F06' 

F.1 Sample content of the EFarr 

This annex contains an example of the contents of EF^j^j^ '2F06'. 

Table F.1 : Access rule references for files located at the MF level 



ARR 
Record 


Applic 
able 


Access 
Condition 


AM DO 


LEN 


Value 


SCDO: 
CRT 
Tag 


Security 
Condition 


Len 


Value 


Key 
Ref 
Tag 


Len 


Value 


Usage 

Qualifier 

Tag 


Len 


Value 


01 


EF 


READ 
UPDATE/ 
DE-ACTIVATE/ 
ACTIVATE 


'80' 
'80' 


■or 

'01' 


'01' 
'1A" 


'90' 
'A4' 


ALW 
Level 5 


'00' 
'06' 


'83' 


'01' 


'OX' 


'95' 


'01' 


'YY' 


02 


EF 


READ 

DEACTIVATE/ 

ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'01' 
'18" 


'90' 
'A4' 


ALW 
Level 5 


'00' 
'06' 


'83' 


'01' 


'OX' 


'95' 


'01' 


'YY' 


03 


EF 


READ 
UPDATE 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 
'80' 


'01' 
'01' 
'01' 


'01' 
'02' 
'18' 


'90' 
'A4' 
'A4' 


ALW 

PIN 

Level 5 


'00' 
'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'01' 
'OX' 


'95' 
'95' 


'01' 
'01' 


'01' 
'YY' 



The value X in table F.1 shall be according to level 5 in table 9.3. The value 'YY' in table F.1 shall be in accordance 
with ISO/IEC 7816-9 [16]. 

As an example, those records could be used as follows: the first record of EF^j^j^ can be the access rule of EFj-,jjj, the 
second record of EF^j^j^ can be the access rule of EFj(-.qjj-,, the third record of EF^j^j^ can be the access rule of EFp^. 
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Annex G (informative): 

Access Rules Referencing (ARR) 

G.1 Sample content of EFarr 

This annex contains a set of access rule examples that are stored in EF^j^j^. The access rules are referenced using tag'SB' 
in the FCP. 

The following definitions apply: 

• the application PIN is referred to as PIN Appl. 1 global (key reference '01'); 

• the UICC supports the usage of a universal PIN, see clause 9.4.1, that is referred to as UNIVERSAL PIN (key 
reference '11'); 

• the application PIN2 is referred to as Second PIN Appl. 1 local (key reference '81'); 

• access condition ADM is referenced as Level 5/Level 6 (key reference 'YZ') where: 

'Y' = '0' for Level 5 and 'Y' = '8' for Level 6; 
'Z' = 'A' to 'E' for Levels and Level 6; 

• the value 'XX' for the usage qualifier for key reference value 'YZ' is according to ISO/IEC 7816-9 [16]. 
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Table G.1 : Application Access Rule References 



ARR 
Record 


Appllc 
able 


Access 
Condition 


AM DO 


LEN 


Value 


SCDO: 
CRT Tag 


Security 
Condition 


Len 


Value 


Key 
Ret 
Taq 


Len 


Value 


Usage 

Qualifier 

Tag 


Len 


Value 


01 


EF 


READ 


'80' 


'01' 


'01' 


'90' 


ALW 


'00' 














02 


EF 


READ 
UPDATE 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 
'80' 


'01' 
'01' 
'01' 


'01' 
'02' 
'18' 


'90' 
'A4' 
'A4' 


ALW 

PIN AppI 1 global 

Level 5/Level 6 


'00' 
'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'01' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


03 


EF 


READ 
UPDATE/ 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'01' 
'1A" 


'A4' 
'A4' 


PIN AppI 1 global 
Level 5/Level 6 


'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'01' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


04 


EF 


READ/UPDATE 

DEACTIVATE/ 

ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'03' 
'18' 


'A4' 
'A4' 


PIN AppI 1 global 
Level 5/Level 6 


'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'01' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


05 


EF 


READ 
UPDATE 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 
'80' 


'01' 
'01' 
'01' 


'01' 
'02' 
'18' 


'A4' 
'A4' 
'A4' 


PIN AppI 1 global 
PIN2 App1 1 local 
Level 5/Level 6 


'00' 
'06' 
'06' 


'83' 
'83' 
'83' 


'01' 
'01' 
'01' 


'01' 
'81' 
'YZ' 


'95' 
'95' 
'95' 


'01' 
'01' 
'01' 


'08' 
'08' 
'XX' 


06 


EF 


READ 
UPDATE/ 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'01' 
'1A" 


'90' 
'A4' 


ALW 

Level 5/Level 6 


'00' 
'06' 


'83' 


'01' 


'YZ' 


'95' 


'01' 


'XX' 


07 


EF 


READ/UPDATE/ 

ACTIVATE 

DEACTIVATE 


'80' 
'80' 


'01' 
'01' 


'13' 
'08' 


'A4' 
'A4' 


PIN AppI 1 global 
Level 5/Level 6 


'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'01' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


08 


EF 


READ/UPDATE/ 

ACTIVATE/ 

DEACTIVATE 


'80' 


'01' 


•IB' 


'A4' 


Level 5/Level 6 


'06' 


'83' 


'01' 


'YZ' 


'95' 


'01' 


'XX' 


09 


EF 


READ/UPDATE 
DEACTIVATE/ 
ACTIVATE 
INCREASE 


'80' 
'80' 

'84' 


'01' 
'01' 

'01' 


'03' 
'18' 

'32' 


'A4' 
'A4' 

'A4' 


PIN AppI 1 global 
Level 5/Level 6 

PIN AppI 1 global 


'06' 
'06' 

'06' 


'83' 
'83' 

'83' 


'01' 
'01' 

'01' 


'01' 
'YZ' 

'01' 


'95' 
'95' 

'95' 


'01' 
'01' 

'01' 


'08' 
'XX' 

'08' 


10 


EF 


READ/UPDATE 
DEACTIVATE/ 
ACTIVATE 
INCREASE 


'80' 
'80' 

'84' 


'01' 
'01' 

'01' 


'03' 
'18' 

'32' 


'A4' 
'A4' 

'A4' 


PIN AppI 1 global 
Level 5/Level 6 

PIN2 App1 1 global 


'06' 
'06' 

'06' 


'83' 
'83' 

'83' 


'01' 
'01' 

'01' 


'01' 
'YZ' 

'81' 


'95' 
'95' 

'95' 


'01' 
'01' 

'01' 


'08' 
'XX' 

'08' 


11 


EF 


READ 
UPDATE 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 
'80' 


'01' 
'01' 
'01' 


'01' 
'02' 
'18' 


'90' 
'A4' 
'A4' 


ALW 

Universal PIN 
Level 5/Level 6 


'00' 
'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'11' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


12 


EF 


READ 
UPDATE/ 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'01' 
'1A" 


'A4' 
'A4' 


Universal PIN 
Level 5/Level 6 


'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'11' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


13 


EF 


READ/UPDATE 

DEACTIVATE/ 

ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'03' 
'18' 


'A4' 
'A4' 


Universal PIN 
Level 5/Level 6 


'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'11' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


14 


EF 


READ 
UPDATE 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 
'80' 


'01' 
'01' 
'01' 


'01' 
'02' 
'18' 


'A4' 
'A4' 
'A4' 


Universal PIN 
PIN2 App1 1 local 
Level 5/Level 6 


'00' 
'06' 
'06' 


'83' 
'83' 
'83' 


'01' 
'01' 
'01' 


'11' 
'81' 
'YZ' 


'95' 
'95' 
'95' 


'01' 
'01' 
'01' 


'08' 
'08' 
'XX' 


15 


EF 


READ 
UPDATE/ 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'01' 
'1A" 


'90' 
'A4' 


ALW 

Level 5/Level 6 


'00' 
'06' 


'83' 


'01' 


'YZ' 


'95' 


'01' 


'XX' 


16 


EF 


READ/UPDATE/ 

ACTIVATE 

DEACTIVATE 


'80' 
'80' 


'01' 
'01' 


'13' 
'08' 


'A4' 
'A4' 


Universal PIN 
Level 5/Level 6 


'06' 
'06' 


'83' 
'83' 


'01' 
'01' 


'11' 
'YZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


17 


EF 


READ/UPDATE/ 

ACTIVATE/ 

DEACTIVATE 


'80' 


'01' 


'IB' 


'A4' 


Level 5/Level 6 


'06' 


'83' 


'01' 


'YZ' 


'95' 


'01' 


'XX' 


18 


EF 


READ/UPDATE 
DEACTIVATE/ 
ACTIVATE 
INCREASE 


'80' 
'80' 

'84' 


'01' 
'01' 

'01' 


'03' 
'18' 

'32' 


'A4' 
'A4' 

'A4' 


Universal PIN 
Level 5/Level 6 

Universal PIN 


'06' 
'06' 

'06' 


'83' 
'83' 

'83' 


'01' 
'01' 

'01' 


'11' 
'YZ' 

'11' 


'95' 
'95' 

'95' 


'01' 
'01' 

'01' 


'08' 
'XX' 

'08' 


19 


EF 


READ/UPDATE 
DEACTIVATE/ 
ACTIVATE 
INCREASE 


'80' 
'80' 

'84' 


'01' 
'01' 

'01' 


'03' 
'18' 

'32' 


'A4' 
'A4' 

'A4' 


Universal PIN 
Level 5/Level 6 

PIN2 App1 1 global 


'06' 
'06' 

'06' 


'83' 
'83' 

'83' 


'01' 
'01' 

'01' 


'11' 
'YZ' 

'81' 


'95' 
'95' 

'95' 


'01' 
'01' 

'01' 


'08' 
'XX' 

'08' 
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Table G.2: DF-rgigpo^ Access Rule References 



ARR 
Record 


Applic 
able 


Access 
Condition 


AM DO 


L 


V 


SCDO 
CRT 
Tag 


Security Condition 


L 


SCDO 
CRT 
Tag 


L 


Value 


SCDO 
CRT 
Tag 


L 


Value 


Key 
Ref 
Tag 


L 


V 


Usage 

Qualifier 

Tag 


L 


V 


Key 
Ref 
Tag 


L 


V 


Usage 

Qualifier 

Tag 


L 


V 


01 


EF 


READ 


'80' 


'01' 


'01' 


'90' 


ALW 


'00' 






- 




- 


- 


- 


- 






- 


- 


- 


- 


- 


- 


02 


EF 


READ 
UPDATE 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 
'80' 


'01' 
'01' 
'01' 


'01' 
'02' 
'18' 


'90' 
'AO' 
'A4' 


ALW 

PIN AppI 1 global OR PIN AppI 2 

Level 5 


'00' 
'10' 
'06' 


'A4' 


'06' 


'83' 
'83' 


'01' 
'01' 


'01' 
'OZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX' 


'A4' 


'06' 


'83' 


'01' 


'02' 


'95' 


'01' 


'08' 


03 


EF 


READ 
UPDATE/ 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'01' 
'1A" 


'AO' 
'A4' 


PIN AppI 1 global OR PIN AppI 2 
Level 5 


'10' 
'06' 


'A4' 




'83' 
'83' 


'01' 
'01' 


'01' 
'OZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX 


'A4' 


'06' 


'83' 


'01' 


'02' 


'95' 


'01' 


'08' 


04 


EF 


READ/UPDATE 

DEACTIVATE/ 

ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'03' 
'18' 


'AO' 
'A4' 


PIN AppI 1 global OR PIN AppI 2 
Level 5 


'10' 
'06' 


'A4' 




'83' 
'83' 


'01' 
'01' 


'01' 
'OZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX 


'A4' 


'06' 


'83' 


'01' 


'02' 


'95' 


'01' 


'08' 


05 


EF 


READ 
UPDATE/ 
DEACTIVATE/ 
ACTIVATE 


'80' 
'80' 


'01' 
'01' 


'01' 
'1A" 


'90' 
'A4' 


ALW 
Level 5 


'00' 
'06' 






'83' 


'01' 


'OZ' 


'95' 


'01' 


'XX 


















06 


EF 


READ/ 
UPDATE/ 
ACTIVATE 
DEACTIVATE 


'80' 
'80' 


'01' 
'01' 


'13' 
'08' 


'AO' 
'A4' 


PIN AppI 1 global OR PIN AppI 2 
Level 5 


'10' 
'06' 


'A4' 




'83' 
'83' 


'01' 
'01' 


'01' 
'OZ' 


'95' 
'95' 


'01' 
'01' 


'08' 
'XX 


'A4' 


'06' 


'83' 


'01' 


'02' 


'95' 


'01' 


'08' 


07 


EF 


READ/UPDATE/ 

DEACTIVATE/ 

ACTIVATE 


'80' 


'01' 


'IB' 


'A4' 


Level 5 


'06' 






'83' 


'01' 


'OZ' 


'95' 


'01' 


'XX' 
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G.2 Example of access rule referencing with SE ID 

This clause describes an example of the usage of the access rule referencing method using SE ID. Table G.l is 
considered to be the EF(ARR) file for this example. 

Assume an application uses PIN Application 1 Global as its application PIN. In addition, this application allows the 
replacement of its application PIN by the Universal PIN. EF(example) is an elementary file part of this application and 
has the following access conditions: 

• READ: Always. 

• UPDATE: PIN application 1 Global. 

• ACTIVATE/DEACTIVATE: level 5 or 6. 

The security attributes returned after the selection of EF(example) then contains a reference to record 2 of table G. 1 for 
SE 01 and a reference to record 11 of table G. 1 for SE 00. 
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Annex H (normative): 
List of SFI Values 

This annex lists SFI values assigned in the present document. 



H.1 List of SFI Values at the MP Level 



File Identifier 


SFI 


Description 


'2FE2' 


'02' 


ICC Identification (EFi^qi^j) 


'2F05' 


'05' 


Preferred Languages (EFpJ 


'2F06' 


'06' 


Access Rules Reference (EF^pp) 


'2F00' 


'1E' 


Application Directory (EFp|p) 



All other SFI values are reserved for future use. 
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Annex I (informative): 

Resets and modes of operation 



This annex contains figures that illustrate selection and switching of modes of operation of the "Type 1 UICC" and 
"Type 2 UICC". 



Deactivation 



Start of a 
card session 



Cold Reset 



ATR without TA(2) 



N.M. = Negotiable Mode 
S.M. = Specific Mode 




PPS Procedure 




Warm reset 



Figure 1.1 : Modes of operation of a "Type 1 UICC" 



Deactivation 



Start of a card 



Deactivation 



Cold Reset 



ATR without TA(2 








ATR with TA(2) 
TA(1): (Fd,Dd) 
TA(2):b8 = 1, b5 = 




Warm reset 








f 





Warm reset 



N.M. = Negotiable Mode 
S.M. = Specific Mode 



T 



ATR with TA(2) 
TA(1):(Fn,Dn) 
TA(2):b8 = 1, b5 = 





Figure 1.2: Modes of operation of a "Type 2 UICC" 
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Annex J (informative): 
Example of the use of PINs 

J.1 Application having several ADFs 

From the security context point of view, 2 ADFs using the same application PIN are part of the same application. Each 
ADF then refers to the same local key reference number whose value and status is specific to each ADF. Figure J.l 
illustrates it. 



Same application from the security context 
point of view (same application PIN) 



ADFl 

PIN '01', value 1234, verified 
PIN '81', value 3456, verified 



ADF2 

PIN '01', value 1234, verified 
PIN '81', value abed, not verified 





DFl 


PIN '01 


, value 1234 


PIN '81 


, value 3456 





DFl 


PIN '01 


, value 1234 


PIN '81 


, value abed 



Figure J.l 



J. 2 Two applications with two different security contexts 

From the security context point of view, two applications use two different application PINs. Then the local PINs of the 
applications use two different key reference numbers, each one paired with its associated application PIN. Figure J. 2 
illustrates this scenario. 



Application 1 



Application 2 



ADFl 

PIN '01', value 1234, verified 
PIN '81', value 3456, verified 



ADF2 

PIN '02', value xyz, verified 
PIN '82', value abed, not verified 



DFl 

PIN '01', value 1234 
PIN '81', value 3456 



DFl 

PIN '02', value xyz 
PIN '82', value abed 



Figure J.2 
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